31d197b7c337bac8d75789403ea8b08e20a93d4cae3fb0facf2b2d89a5dbc8d1

Analysis

max time kernel
203s
max time network
207s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 03:52

Target

31d197b7c337bac8d75789403ea8b08e20a93d4cae3fb0facf2b2d89a5dbc8d1.dll
Size

231KB
MD5

15ab2a492c09e08eb0e4399b3b87d797
SHA1

a80b29b2dc33edf265e4b2ea1ba017a52fa826ae
SHA256

31d197b7c337bac8d75789403ea8b08e20a93d4cae3fb0facf2b2d89a5dbc8d1
SHA512

44666255da9ff14b40bf0d7e43a3b7867adca2c8c3c53a76a284274079aae067290a19541d80b044d6da37d798a0db24b92a6cca8ef7cd814fc9995e9ebfce15
SSDEEP

6144:nDYBMQj84J3h4G+DCiOo8Gx+VFF87Ei3:nVSVUCiOo9xK87Ek

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4208	4800	rundll32.exe	82
PID 4800 wrote to memory of 4208	4800	rundll32.exe	82
PID 4800 wrote to memory of 4208	4800	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31d197b7c337bac8d75789403ea8b08e20a93d4cae3fb0facf2b2d89a5dbc8d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31d197b7c337bac8d75789403ea8b08e20a93d4cae3fb0facf2b2d89a5dbc8d1.dll,#1
  2⤵
  PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4208 -ip 4208
1⤵
PID:4112