dba0d741dd62e61776ec42115faf046cc9cb617411d60757a2c07fdd2beb6a6a

Resubmissions

22-09-2022 16:56

22-09-2022 16:47

13-09-2022 17:49

Target

0c2a3456d8a82f95e615fbff0a35740e.dll
Size

2.7MB
MD5

0c2a3456d8a82f95e615fbff0a35740e
SHA1

088236f029a63fe956fd1533f540d667c758d50f
SHA256

dba0d741dd62e61776ec42115faf046cc9cb617411d60757a2c07fdd2beb6a6a
SHA512

832b147a70f58fbd55aa869dcf612f2b109667d0a3f140e18cd0f6925ee5b4db00edfbbdf13b5e912c5b96d7127df991aba08b5a3f5770873fe17823bdea1728
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcf2ek:P1Kqvv07noI7lOOYcp

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1064 968 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1064	968	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1064	968	rundll32.exe	WerFault.exe
PID 968 wrote to memory of 1064	968	rundll32.exe	WerFault.exe
PID 968 wrote to memory of 1064	968	rundll32.exe	WerFault.exe
PID 968 wrote to memory of 1064	968	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c2a3456d8a82f95e615fbff0a35740e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c2a3456d8a82f95e615fbff0a35740e.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 196
    3⤵
    - Program crash
    PID:1064

memory/968-54-0x0000000000000000-mapping.dmp

Download
memory/968-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1064-56-0x0000000000000000-mapping.dmp

Download