0213a0d183b593976c20511515be077f94595a3993bfc496e9c4783a506c147e

Resubmissions

26/09/2022, 13:23

26/09/2022, 13:23

26/09/2022, 13:21

25/09/2022, 11:08

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/09/2022, 11:08

Target

StOMW0ci.dll
Size

2.5MB
MD5

30f0b4c68317a320227389dc671e32c2
SHA1

4cc428c3355504fbc7fa68ab44c4f8c43938adc1
SHA256

0213a0d183b593976c20511515be077f94595a3993bfc496e9c4783a506c147e
SHA512

9f8f9651189a84f9177d2ac14bb73f563f549127e5b5700892127911f93edfb5f80a40469eefa37d0baa2073c47c9b5d01d47cee831fa704ac77d1972bedf746
SSDEEP

49152:/UV3vnVxDtgL47ZbH8TGN8DC9Vj7iRJrd1skW3/gsykrC+PhqJlT89i3FCQuweF7:SVNtSYZbH8TGNYC9Vj7iRJrbskg/gsya

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	1196	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 856	1196	rundll32.exe	27
PID 1196 wrote to memory of 856	1196	rundll32.exe	27
PID 1196 wrote to memory of 856	1196	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\StOMW0ci.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1196 -s 84
  2⤵
  - Program crash
  PID:856