fdd7ebd0eafe38d33e0a3d42fdc4935266b35da063bc6874bc0ffd3cb05ff892

Resubmissions

22/09/2022, 16:56

22/09/2022, 16:46

13/09/2022, 17:49

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/09/2022, 16:46

Target
25c5264d16b42bf798913e90ecf32ea2.dll
Size 2.7MB
Sample220922-vacevsffgq
SHA256 fdd7ebd0eafe38d33e0a3d42fdc4935266b35da063bc6874bc0ffd3cb05ff892
MD5 25c5264d16b42bf798913e90ecf32ea2
SHA1 24529aaf2ca70f05e148d49cd9f6a1fe398ec129
SHA512 4d6124a0ca76b81cc9c899341d5e6384e3acc19cfad36ea4780f5d6c30968b92535acd347b36d82121ed8a845d372e2c0398a7c9815264a9da287a5440070dd5
SSDEEP 49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcT2ek:P1Kqvv07noI7lOOYcl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4488	4160	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 4160	4528	rundll32.exe	82
PID 4528 wrote to memory of 4160	4528	rundll32.exe	82
PID 4528 wrote to memory of 4160	4528	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25c5264d16b42bf798913e90ecf32ea2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25c5264d16b42bf798913e90ecf32ea2.dll,#1
  2⤵
  PID:4160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 560
    3⤵
    - Program crash
    PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4160 -ip 4160
1⤵
PID:4416