67ab0ac904751a8c8578d27f8f85f0569d7364bb2d8ee047068a9127a891292c

Analysis

max time kernel
187s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 04:45

Target

67ab0ac904751a8c8578d27f8f85f0569d7364bb2d8ee047068a9127a891292c.dll
Size

124KB
MD5

0c1e282c0e6917358cbd323bc7831552
SHA1

b06bc7670d39274c673fbe7c5971e32b5c335ed5
SHA256

67ab0ac904751a8c8578d27f8f85f0569d7364bb2d8ee047068a9127a891292c
SHA512

1c9e78c31a7e6a2e3d8fd513106d656618dce48f9ca4448e25f8d9c6f6a3fccf861c130be51431453fd09bd49c97a2e95afdd79a0e40de7158c657f6aeb25d4e
SSDEEP

768:wfIhXaz8Ra9U8/19A5AhzcI+/idoCG+8xcYytV9LZKGQszl2kqLbZK3XT8O5Y8:wghXazoIhNXd0xspLZzzl2kuYHoO

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\windhcp.ocx	rundll32.exe
File created	C:\Windows\SysWOW64\windhcp.ocx	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3940	4584	WerFault.exe	78
1340	4584	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4584	rundll32.exe
4584	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4584	4248	rundll32.exe	78
PID 4248 wrote to memory of 4584	4248	rundll32.exe	78
PID 4248 wrote to memory of 4584	4248	rundll32.exe	78
PID 4584 wrote to memory of 3940	4584	rundll32.exe	81
PID 4584 wrote to memory of 3940	4584	rundll32.exe	81
PID 4584 wrote to memory of 3940	4584	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67ab0ac904751a8c8578d27f8f85f0569d7364bb2d8ee047068a9127a891292c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\67ab0ac904751a8c8578d27f8f85f0569d7364bb2d8ee047068a9127a891292c.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 652
    3⤵
    - Program crash
    PID:3940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 652
    3⤵
    - Program crash
    PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4584 -ip 4584
1⤵
PID:1696

memory/4584-133-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download