6734e708c6beaf74eeca069129144d5fe7aec8b9a3ac3154a1e5df6647782f9b

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2022, 04:33

Target

CADe_SIMUdqfz电路图仿真软件/CADe_SIMUdqfz/MSVCRTD.dll
Size

156KB
MD5

36281bb9a843fcfc4edf98b036c86152
SHA1

aa0bb1bfe2811c3343c6bdc70b27c9d59490ee2c
SHA256

97c22e2f2f6ec8efb43be2ff893cafd2134b4df994c4b81d5f8941efd7d87a1d
SHA512

d150970e161afe56790c2dd11a63ff505487552e1af9286a502f0af66d65e62cfc8eab6871226616a876eae0373047a65b49011e21c45996e6f30e2c41be1a19
SSDEEP

3072:8JtSK78ev6xXxxHBp+js0F74v/XT69vyBya1tFGmB7z/oNrtrkFk3MWiFhPNSIR3:gSs8TBpLeRcv/qyBy2GmCtr8k3MWiFJW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
852	5008	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 5008	552	rundll32.exe	83
PID 552 wrote to memory of 5008	552	rundll32.exe	83
PID 552 wrote to memory of 5008	552	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CADe_SIMUdqfz电路图仿真软件\CADe_SIMUdqfz\MSVCRTD.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CADe_SIMUdqfz电路图仿真软件\CADe_SIMUdqfz\MSVCRTD.dll,#1
  2⤵
  PID:5008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 600
    3⤵
    - Program crash
    PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5008 -ip 5008
1⤵
PID:3308

memory/5008-133-0x0000000010200000-0x0000000010263000-memory.dmp

Filesize
396KB

Download