2911bdd99140387cbc8761826aacc3c9de0ccb511255aa58790955d8337e2edf

Resubmissions

18/11/2022, 10:31

18/11/2022, 01:25

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2022, 10:31

Target

UkBuGFiaRxAAfl.dll
Size

970KB
MD5

a779d5cf3fa450bdf0f540054861ba62
SHA1

4fe25852f69640e87e240b5e4bc46fdfc76782c7
SHA256

2911bdd99140387cbc8761826aacc3c9de0ccb511255aa58790955d8337e2edf
SHA512

1db51d312dfa647038d2c0c9afbd11852b4bdb177a07894f84db04d3547a3d06257900c597f9bb514bfcdcfd027fbcbe22552dbf73262f8f6e30920025ea3f50
SSDEEP

12288:ZZ33fS04yxlif6aS8dqJJzkvyo4w9faJ+1NEDeX4d8FWkPQz8028ez+R7Fnjmz2q:ZZ33agIddqFY9CJ+1V4oWdY8ec7BjI4

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
532	4528	WerFault.exe	45
64	3004	WerFault.exe	92

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 3004	208	cmd.exe	92
PID 208 wrote to memory of 3004	208	cmd.exe	92
PID 208 wrote to memory of 4036	208	cmd.exe	95
PID 208 wrote to memory of 4036	208	cmd.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UkBuGFiaRxAAfl.dll,#1
1⤵
PID:4528
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4528 -s 328
  2⤵
  - Program crash
  PID:532

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 412 -p 4528 -ip 4528
1⤵
PID:1048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\system32\rundll32.exe
  rundll32.exe UkBuGFiaRxAAfl.dll #1
  2⤵
  PID:3004
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3004 -s 344
    3⤵
    - Program crash
    PID:64
- C:\Windows\system32\rundll32.exe
  rundll32.exe UkBuGFiaRxAAfl.dll #2
  2⤵
  PID:4036

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 3004 -ip 3004
1⤵
PID:3216