dba0d741dd62e61776ec42115faf046cc9cb617411d60757a2c07fdd2beb6a6a

Resubmissions

22/09/2022, 16:56

22/09/2022, 16:47

13/09/2022, 17:49

max time kernel
61s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2022, 16:47

Target
0c2a3456d8a82f95e615fbff0a35740e.dll
Size 2.7MB
Sample220922-va1gpaffgr
SHA256 dba0d741dd62e61776ec42115faf046cc9cb617411d60757a2c07fdd2beb6a6a
MD5 0c2a3456d8a82f95e615fbff0a35740e
SHA1 088236f029a63fe956fd1533f540d667c758d50f
SHA512 832b147a70f58fbd55aa869dcf612f2b109667d0a3f140e18cd0f6925ee5b4db00edfbbdf13b5e912c5b96d7127df991aba08b5a3f5770873fe17823bdea1728
SSDEEP 49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcf2ek:P1Kqvv07noI7lOOYcp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	4308	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 4308	3444	rundll32.exe	80
PID 3444 wrote to memory of 4308	3444	rundll32.exe	80
PID 3444 wrote to memory of 4308	3444	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c2a3456d8a82f95e615fbff0a35740e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c2a3456d8a82f95e615fbff0a35740e.dll,#1
  2⤵
  PID:4308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 560
    3⤵
    - Program crash
    PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4308 -ip 4308
1⤵
PID:2800