009ed2a5315fe6c3897ce9603f8b525651b95861f9f3cc715a1388effa3c3062

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 19:36

Target

009ed2a5315fe6c3897ce9603f8b525651b95861f9f3cc715a1388effa3c3062.dll
Size

292KB
MD5

fc23d620357340fec7069302166c5436
SHA1

5fb2c734bb1ce1b10f55c951a4e4ec625c9de972
SHA256

009ed2a5315fe6c3897ce9603f8b525651b95861f9f3cc715a1388effa3c3062
SHA512

1893c14d2b807cf8389b426775249bebb00c4d1f7a530070e2ee5851597c3f8f1c27211161c7a31aa8f92aea33d99f60c020b65f64fde84667d91cf5c659cb7e
SSDEEP

6144:GJFDU6PBC2WOXZHVu5PkotBpkMfay5PjP9pw:GJVJPBCmXzu5MozNay5L

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

uVoPhHEgm

pid process

1428 uVoPhHEgm
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3716 1428 WerFault.exe uVoPhHEgm
2812 1428 WerFault.exe uVoPhHEgm

pid	process
1428	uVoPhHEgm

pid	pid_target	process	target process
3716	1428	WerFault.exe	uVoPhHEgm
2812	1428	WerFault.exe	uVoPhHEgm

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

rundll32.exerundll32.exeuVoPhHEgm

description	pid	process	target process
PID 2212 wrote to memory of 1960	2212	rundll32.exe	rundll32.exe
PID 2212 wrote to memory of 1960	2212	rundll32.exe	rundll32.exe
PID 2212 wrote to memory of 1960	2212	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 1428	1960	rundll32.exe	uVoPhHEgm
PID 1960 wrote to memory of 1428	1960	rundll32.exe	uVoPhHEgm
PID 1960 wrote to memory of 1428	1960	rundll32.exe	uVoPhHEgm
PID 1428 wrote to memory of 3716	1428	uVoPhHEgm	WerFault.exe
PID 1428 wrote to memory of 3716	1428	uVoPhHEgm	WerFault.exe
PID 1428 wrote to memory of 3716	1428	uVoPhHEgm	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\009ed2a5315fe6c3897ce9603f8b525651b95861f9f3cc715a1388effa3c3062.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\009ed2a5315fe6c3897ce9603f8b525651b95861f9f3cc715a1388effa3c3062.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 196
4⤵
- Program crash
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 196
4⤵
- Program crash
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1428 -ip 1428
1⤵
PID:1372

C:\Users\Admin\AppData\Local\Temp\uVoPhHEgm
Filesize
92KB

MD5
69b702ec5b32f2cf025e9961bee612a0

SHA1
e4ceb28f770d0397a64492d0e400b56e29beb898

SHA256
8801635867cae2bb98c1c080d3a1c007a66d88be1532534cb58293f333510e3a

SHA512
31a239d36263d8c7032848c1be844a455208e330ddf62dfe080a74901ff64838e6f3ce6e5efc5f8a85a69c257471fea3d30feef795440cba4991662393ae4182

Download Submit
memory/1428-133-0x0000000000000000-mapping.dmp

Download
memory/1428-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1960-132-0x0000000000000000-mapping.dmp

Download
memory/3716-136-0x0000000000000000-mapping.dmp

Download