8e0e38ed2f8c46569c0b1d250f3e66b190d256a7fa0824bd5d3e8bf215fb5ce2

Analysis

max time kernel
175s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 22:24

Target

rxbaoV3.29_Y/bb.dll
Size

97KB
MD5

040aae2e851338bdce796420914e928a
SHA1

97600fbd2fec878923a722bc054e3e4803127f8f
SHA256

a36b0b3703928f46c9f648910eeff253aa6fa702614e173e05b95d902416d8d2
SHA512

ca63da2e759f5c7c2cf17619131b2e26a8cadbede291005546634593aaa16baefec302e4586c232e9f550e1ae4a2d1b2e8ffe1e98f4ade7d49ea59c1e4c6c82c
SSDEEP

1536:wkxaf6YvvCiBAR66FIU66zKZyUqRWnLwNPoAyqyuy5d98xCUzan1SKmHI:woYO66FxeUHWAyJ5daxCUzK1SKT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1472 2252 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1472	2252	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5036 wrote to memory of 2252	5036	rundll32.exe	rundll32.exe
PID 5036 wrote to memory of 2252	5036	rundll32.exe	rundll32.exe
PID 5036 wrote to memory of 2252	5036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\rxbaoV3.29_Y\bb.dll,#1
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 600
    3⤵
    - Program crash
    PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2252 -ip 2252
1⤵
PID:2556