8aa57051e2d9b8d7398e47b5cdabd32df0b28696a32d1d44a8bb6b463b1f3ddb

Analysis

max time kernel
134s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2022, 18:25

Target
Softiwe Download/storelib.dll
Size 159KB
Sample221110-w2ly2secfj
SHA256 6b29cad1f6da51f45b7164758a16328eaac9f31021e9172dd3d2f1d0d672da99
MD5 aedf4928d0ed444609abcaab5d8ef334
SHA1 b3f81d2cd9191151742cd96158e0a17710b8dbbc
SHA512 9ad07d5dcc61208d535bea2472c2244aedd18ab274a6657893036fa42ce2ea297c6244f352e7d64a24d2788d329b3d3d82c98f71f27d6e227a2b8b20ad6c0756
SSDEEP 3072:Swpq71+8xl3WyCdJROjSeIt4+/e792t2K5zo9dRa:Sv0wh2dYSeIt4+c9I
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	4212	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4212	4352	rundll32.exe	79
PID 4352 wrote to memory of 4212	4352	rundll32.exe	79
PID 4352 wrote to memory of 4212	4352	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Softiwe Download\storelib.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Softiwe Download\storelib.dll",#1
  2⤵
  PID:4212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 612
    3⤵
    - Program crash
    PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4212 -ip 4212
1⤵
PID:4300