add170faa3d2a629d9fdd4d71c1652b8a42309d67a86bd52024ea86c5fa1d7a9

Analysis

max time kernel
92s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2022, 09:25

Target
123e2c58.dll
Size 676KB
Sample220920-ldngvscee6
SHA256 add170faa3d2a629d9fdd4d71c1652b8a42309d67a86bd52024ea86c5fa1d7a9
MD5 e1a8e00a06f26ef92e01e48ba39cae74
SHA1 06b73afa6db30f6d9b35846cdef32b8212406702
SHA512 e90cbcb5e965276257a3f5f88076bf9f38129a3cd11414f2c4f99c71d2ee8b75831713b970e9b7de830986ef625f8ea20f96adab15a231d00318147793476a6e
SSDEEP 12288:NymbIP35LmP3bS1qRlP5ukahaNNLiBaFNmz1lZxjSiXrwsHphTukEtv:NymcP3oPG1qRoha/qaa5t5VJhSkEx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	4568	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	4568	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4568	4756	rundll32.exe	84
PID 4756 wrote to memory of 4568	4756	rundll32.exe	84
PID 4756 wrote to memory of 4568	4756	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\123e2c58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\123e2c58.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:4568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 692
    3⤵
    - Program crash
    PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4568 -ip 4568
1⤵
PID:632