8aa57051e2d9b8d7398e47b5cdabd32df0b28696a32d1d44a8bb6b463b1f3ddb

Analysis

max time kernel
142s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2022, 18:25

Target
Softiwe Download/storelibir-2.dll
Size 275KB
Sample221110-w2ly2secfj
SHA256 833cdbcac5781d350af6939422c770b5194de1bc0cc1bbd38cd929256f440bbf
MD5 ffb6b65a71232e4b692cb33af2d0cdf8
SHA1 c0758d6dd87e80c187e006bb8d6f084260c09a77
SHA512 70fee00acf8882e40e4e33ca1aa021e3833ead9e00ae197935fa859c962dacd5e2272c5da5b13f1633219eb6b1dabe37ff335c653c94cdccde95526f18684811
SSDEEP 6144:DaAGE61xLaj7jShlyq/b9S9hQWEIyDWvLWR:Db61xLaDTqbeQWEPbR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4476	4236	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 4236	880	rundll32.exe	81
PID 880 wrote to memory of 4236	880	rundll32.exe	81
PID 880 wrote to memory of 4236	880	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Softiwe Download\storelibir-2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Softiwe Download\storelibir-2.dll",#1
  2⤵
  PID:4236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 612
    3⤵
    - Program crash
    PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4236 -ip 4236
1⤵
PID:1620