1d3b4a17aad9afb9fb8f64c8dc2b881447f86e6415abeb4ff108f30ce09391d1

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2022 22:15

Target

3550/candlestick.dll
Size

1.4MB
MD5

d2b373df1eb012c206269049e636d26f
SHA1

e291ce3f2496a72851270c05ffb43017827453c3
SHA256

80556052a05684ca0f8729c182aa3a48abb040fe5e358b6f67833b52dbd1c172
SHA512

21de696001564c674cf7a1803595a9d13acf1888962223bb24b8d92c043e5b6899eb2ac1d4cdbcdb39fdd60c965f7952607fa1e7d2bcdc4cdf8564c574dcf88a
SSDEEP

12288:YYKepSeIUqeXPwyITtxGvvVeHTe7ezGNTTYmRs867u0iROkDQSpu8ahK+UfxEeEK:BLo2ftMzeaKYKu7u0i9wofxEaz32w

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1408	3868	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3868	rundll32.exe
3868	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3868	2876	rundll32.exe	82
PID 2876 wrote to memory of 3868	2876	rundll32.exe	82
PID 2876 wrote to memory of 3868	2876	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3550\candlestick.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3550\candlestick.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 680
    3⤵
    - Program crash
    PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3868 -ip 3868
1⤵
PID:3324

memory/3868-132-0x0000000000000000-mapping.dmp

Download
memory/3868-133-0x00000000021F0000-0x000000000235B000-memory.dmp

Filesize
1.4MB

Download
memory/3868-134-0x0000000002950000-0x0000000002979000-memory.dmp

Filesize
164KB

Download
memory/3868-136-0x0000000002950000-0x0000000002979000-memory.dmp

Filesize
164KB

Download
memory/3868-135-0x0000000002990000-0x00000000029E0000-memory.dmp

Filesize
320KB

Download