c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65

Analysis

max time kernel
153s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:58

Target

c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65.dll
Size

272KB
MD5

15d184d15a7a777fe23b2f73a9c97a2c
SHA1

aae7d3db6cb0d071050e422849ebc0fbb66f2930
SHA256

c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65
SHA512

bb19995b26cc78b4ec5904f96c2348e28dcb01a7e073def2b800a0c5c43ebb87ea3f26b0343d482d89b4ee90d814d178f9c0e206d060207ad52405d9aac0425d
SSDEEP

3072:V4vR1RkTcZ7fcxdl5CTxlGuo7EI4Mvu/JQtmLYPrLjoxCvC1uHxMFsk3p/g+wFaG:VolGAMsur/GpF/iYsbjA5o

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

rundll32mgr.exe

pid process

4892 rundll32mgr.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2496 4892 WerFault.exe rundll32mgr.exe

pid	process
4892	rundll32mgr.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

pid	pid_target	process	target process
2496	4892	WerFault.exe	rundll32mgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1128 wrote to memory of 4536	1128	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 4536	1128	rundll32.exe	rundll32.exe
PID 1128 wrote to memory of 4536	1128	rundll32.exe	rundll32.exe
PID 4536 wrote to memory of 4892	4536	rundll32.exe	rundll32mgr.exe
PID 4536 wrote to memory of 4892	4536	rundll32.exe	rundll32mgr.exe
PID 4536 wrote to memory of 4892	4536	rundll32.exe	rundll32mgr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c10ba6650125d86815fb245144516f2286eeba942a34b69581156092033e3f65.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1128

C:\Windows\SysWOW64\rundll32mgr.exe
C:\Windows\SysWOW64\rundll32mgr.exe
3⤵
- Executes dropped EXE
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 248
4⤵
- Program crash
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4892 -ip 4892
1⤵
PID:3432

C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
111KB

MD5
56eddadc5887ee38e44cba3d11d4505f

SHA1
39fba3857b64a678caf9f46eb8b06fcbebd88ff6

SHA256
3af2891edb39edc91e678b6adfb81831ea8b35d6ba2e0539f15d3dc95e427f37

SHA512
9b88e710505f739ac53e64e8fbf2a964380b10fd15f2789e3b5082fbcd697cf77bc057c152331b764e2ccb62071224aff400080cf7f7c33dea9ebd98de150f4e

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe
Filesize
111KB

MD5
56eddadc5887ee38e44cba3d11d4505f

SHA1
39fba3857b64a678caf9f46eb8b06fcbebd88ff6

SHA256
3af2891edb39edc91e678b6adfb81831ea8b35d6ba2e0539f15d3dc95e427f37

SHA512
9b88e710505f739ac53e64e8fbf2a964380b10fd15f2789e3b5082fbcd697cf77bc057c152331b764e2ccb62071224aff400080cf7f7c33dea9ebd98de150f4e

Download Submit
memory/4536-132-0x0000000000000000-mapping.dmp

Download
memory/4892-133-0x0000000000000000-mapping.dmp

Download
memory/4892-135-0x000000000042A000-0x0000000000438000-memory.dmp

Filesize
56KB

Download
memory/4892-137-0x0000000000400000-0x0000000000437CD0-memory.dmp

Filesize
223KB

Download