b95c4f354f85a335502b63cbea99686ab2129897d7a81fa096a8ad80c6424eb4

Analysis

max time kernel
148s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2022, 06:09

Target

txtonly.dll
Size

11KB
MD5

5bb212389d37da3efb3063fb62d478c5
SHA1

db4919984b95e101abab7502910a7994ab849bbe
SHA256

cdacd102c721a2b486dbe2c68a61d243772913aa8805275f95ea3451a6ac7dae
SHA512

ec10b094f8d11ed6d0c4edd01b798aace665942c54731db9807805c3cdff6b3170e056ae6b9a28fda56677f6b40e5bc43beb7bfdb23a3a4ecfd2da24741ed0c4
SSDEEP

48:6GJpXEl9rWm7bLk33jEECm7vWxtlZW8IKL/hll5WGJqlkHk2KJ+fGfGfnfC5upCM:M7BIwtjWxIZlDWxkHAT529PNVE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4804	3516	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3516	4660	rundll32.exe	81
PID 4660 wrote to memory of 3516	4660	rundll32.exe	81
PID 4660 wrote to memory of 3516	4660	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\txtonly.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\txtonly.dll,#1
  2⤵
  PID:3516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 608
    3⤵
    - Program crash
    PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3516 -ip 3516
1⤵
PID:260