dbdd38479854515348488b9bbc94698710b2edf2245bef0ad15defce1d9f4580

Analysis

max time kernel
78s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2022, 02:26

Target

12551/NOISE_FULL_B_24/unrar.dll
Size

154KB
MD5

3fda563a0d2742c0a2475459a1619a28
SHA1

43acbf63a1e8170450709745043a86fe908e8f31
SHA256

fb5549b9e61fe4ce603545edf6e02086e0e5eb02429ca88ac09c5fe79fbf94f0
SHA512

4735e6d1b6c41efbb0179644c6cfed949c048ff112d08dbcb55ab1f65aaaf406fe69bd95dd785cd4e4366db33fb3e3928d87f871d5f063bc59806b9859418438
SSDEEP

3072:87Qdumw6LCZpzw9q2tt3r0hubP1oRYbssQ/nz7z6JIAzk7vSMoyjAq5cqHz9ZM6:TdLwjZpzO9z3rbb2ugB/nz7WyjAqeqHp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	3432	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3432	1104	rundll32.exe	83
PID 1104 wrote to memory of 3432	1104	rundll32.exe	83
PID 1104 wrote to memory of 3432	1104	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12551\NOISE_FULL_B_24\unrar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\12551\NOISE_FULL_B_24\unrar.dll,#1
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 616
    3⤵
    - Program crash
    PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3432 -ip 3432
1⤵
PID:3752