3eddef18a197bcaa1a07e0103d839d6c28439a1313fba7febfb94fca59ad7bd2

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 00:19

Target

3eddef18a197bcaa1a07e0103d839d6c28439a1313fba7febfb94fca59ad7bd2.dll
Size

228KB
MD5

4e884b22da88694c27474f17e34b6020
SHA1

fc8518b113a9445803a950f22d86c5f7d1ae9e71
SHA256

3eddef18a197bcaa1a07e0103d839d6c28439a1313fba7febfb94fca59ad7bd2
SHA512

a6942c112a778880a4cd04e6a9a833f3073724c31d74a799fb3d7a964f849e520cbfeea97f220a47fe73fc70670982c148f72ffb683aa77352cf9d4705fd9b58
SSDEEP

6144:sudAcoUrATt5dUsZrZXG0GP+Rg1f6oeAVONjaTLsthE:siSt0wdXG7+RgniNdrE

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1036	rundll32mgr.exe

Loads dropped DLL 1 IoCs

pid	Process
1036	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1436	1036	WerFault.exe	84

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 1088	2212	rundll32.exe	83
PID 2212 wrote to memory of 1088	2212	rundll32.exe	83
PID 2212 wrote to memory of 1088	2212	rundll32.exe	83
PID 1088 wrote to memory of 1036	1088	rundll32.exe	84
PID 1088 wrote to memory of 1036	1088	rundll32.exe	84
PID 1088 wrote to memory of 1036	1088	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eddef18a197bcaa1a07e0103d839d6c28439a1313fba7febfb94fca59ad7bd2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eddef18a197bcaa1a07e0103d839d6c28439a1313fba7febfb94fca59ad7bd2.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 372
      4⤵
      Program crash
      PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1036 -ip 1036
1⤵
PID:2276

C:\Users\Admin\AppData\Local\Temp\~TME40C.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
153KB

MD5
e84cad1ecbe3a05244060b9f546b2632

SHA1
46db86aa7f8f90de9a26dd61c22fe64701d2aa5d

SHA256
760d5dffc9839deeff5346c38ab39be2b67deb8d7b87c9a290d78133f2ec4bd0

SHA512
47383ec8ecbd285aedfa787386f9412a6e857dbdb385f17187aa8f81ec3429051649a3931bc0788c992050706108b9507a1257100658baeb16add2a0aec094e9

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
153KB

MD5
e84cad1ecbe3a05244060b9f546b2632

SHA1
46db86aa7f8f90de9a26dd61c22fe64701d2aa5d

SHA256
760d5dffc9839deeff5346c38ab39be2b67deb8d7b87c9a290d78133f2ec4bd0

SHA512
47383ec8ecbd285aedfa787386f9412a6e857dbdb385f17187aa8f81ec3429051649a3931bc0788c992050706108b9507a1257100658baeb16add2a0aec094e9

Download Submit
memory/1036-136-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1036-138-0x0000000077000000-0x00000000771A3000-memory.dmp

Filesize
1.6MB

Download
memory/1036-139-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/1036-140-0x0000000077000000-0x00000000771A3000-memory.dmp

Filesize
1.6MB

Download