bd08dc465843f1173f0895d14cfa9b6fb61ca036d68d074acb53d076ad8a796e

Analysis

max time kernel
90s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 06:13

Target

bd08dc465843f1173f0895d14cfa9b6fb61ca036d68d074acb53d076ad8a796e.dll
Size

148KB
MD5

aa846b78a66c640388a0d835a8f95550
SHA1

19f01d78f400048b3a47ec6ccd0395e0913d3577
SHA256

bd08dc465843f1173f0895d14cfa9b6fb61ca036d68d074acb53d076ad8a796e
SHA512

96af12d971c8299968b7266fac4c83a415fc881eefd19e525bea39bb8ce061918341a2b575f51299ebc5a9b802c85f5ba8290a4ae4904ff0ab45cff09ccc7db3
SSDEEP

3072:OdJrDIYNcf6Ys0bboG9SnQCa1ePvwttNiL064m0h+Z6v9XCdQx0:OEYNcf643gTvwttUL064m0hhsdK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3948	2732	WerFault.exe	80

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\EV_HMAC_SISO_40M - m_RxMax AgcParams.m_RxDelay: up faileA	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2732	1688	rundll32.exe	80
PID 1688 wrote to memory of 2732	1688	rundll32.exe	80
PID 1688 wrote to memory of 2732	1688	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd08dc465843f1173f0895d14cfa9b6fb61ca036d68d074acb53d076ad8a796e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd08dc465843f1173f0895d14cfa9b6fb61ca036d68d074acb53d076ad8a796e.dll,#1
  2⤵
  - NTFS ADS
  PID:2732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 616
    3⤵
    - Program crash
    PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2732 -ip 2732
1⤵
PID:2276