a28e3c550eb65762971c2e6f675540d4f9f830304b7bf0dba2ca39d7cace8ef4

Resubmissions

14/10/2022, 07:00

12/10/2022, 08:00

max time kernel
92s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 08:00

Target

3550/pots.dll
Size

1.4MB
MD5

d2b373df1eb012c206269049e636d26f
SHA1

e291ce3f2496a72851270c05ffb43017827453c3
SHA256

80556052a05684ca0f8729c182aa3a48abb040fe5e358b6f67833b52dbd1c172
SHA512

21de696001564c674cf7a1803595a9d13acf1888962223bb24b8d92c043e5b6899eb2ac1d4cdbcdb39fdd60c965f7952607fa1e7d2bcdc4cdf8564c574dcf88a
SSDEEP

12288:YYKepSeIUqeXPwyITtxGvvVeHTe7ezGNTTYmRs867u0iROkDQSpu8ahK+UfxEeEK:BLo2ftMzeaKYKu7u0i9wofxEaz32w

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4964	1376	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	rundll32.exe
1376	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 1376	3796	rundll32.exe	81
PID 3796 wrote to memory of 1376	3796	rundll32.exe	81
PID 3796 wrote to memory of 1376	3796	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3550\pots.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3550\pots.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 680
    3⤵
    - Program crash
    PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1376 -ip 1376
1⤵
PID:4892

memory/1376-133-0x00000000031E0000-0x0000000003209000-memory.dmp

Filesize
164KB

Download
memory/1376-134-0x0000000001460000-0x00000000014B0000-memory.dmp

Filesize
320KB

Download
memory/1376-135-0x00000000031E0000-0x0000000003209000-memory.dmp

Filesize
164KB

Download
memory/1376-136-0x00000000031E0000-0x0000000003209000-memory.dmp

Filesize
164KB

Download