0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 21:34

Target

0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9.dll
Size

422KB
MD5

0ea3292d91c3ff540ee07e5605204e60
SHA1

b6c36ae4c3bf39936501cedf0ee510508ac3b531
SHA256

0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9
SHA512

e1b6ee7fdcc5aef39580de4aa403810e5ea403332d657142c2d3a7436c08efb073f55073c0b31408c0898dbb35798b492d38c72691bfae2a9d042bdf71858d6c
SSDEEP

12288:j79qXvjRc5AoIY+NPUlWnVaKy3olgtErA:VqXvjRc5AoITcknAKm8g2k

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3768	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	3768	WerFault.exe	80

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 5072	1496	rundll32.exe	79
PID 1496 wrote to memory of 5072	1496	rundll32.exe	79
PID 1496 wrote to memory of 5072	1496	rundll32.exe	79
PID 5072 wrote to memory of 3768	5072	rundll32.exe	80
PID 5072 wrote to memory of 3768	5072	rundll32.exe	80
PID 5072 wrote to memory of 3768	5072	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c3480dd468d7b379e80f71f8389c8194b601e05e9dbca04d58e83aee507e1c9.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:3768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 272
      4⤵
      Program crash
      PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3768 -ip 3768
1⤵
PID:1532

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
87KB

MD5
58da7ff3c598b41bbe4cb76d5666aaa8

SHA1
e0b965f7a4e4bbeede3d1d4a82beab1209b2f2f6

SHA256
885c8e15532b46d2203b50c67f593288968be6d5f7c79e19b637e0129a1f5987

SHA512
c05ead242fe60c4aea4a034748edc2329cc31ebcad7b9895d1d0cc8a01e2891d40cfd2adda733780c5ecec0abbad71d5a30e55659752ee7199dadc3332cf027b

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
87KB

MD5
58da7ff3c598b41bbe4cb76d5666aaa8

SHA1
e0b965f7a4e4bbeede3d1d4a82beab1209b2f2f6

SHA256
885c8e15532b46d2203b50c67f593288968be6d5f7c79e19b637e0129a1f5987

SHA512
c05ead242fe60c4aea4a034748edc2329cc31ebcad7b9895d1d0cc8a01e2891d40cfd2adda733780c5ecec0abbad71d5a30e55659752ee7199dadc3332cf027b

Download Submit
memory/3768-136-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download