9bacbe6aa854abb9a0f8bfda9692e0f39f910c050158444f4eada541764abc19

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 19:54

Target

9bacbe6aa854abb9a0f8bfda9692e0f39f910c050158444f4eada541764abc19.dll
Size

19KB
MD5

f8334cbe4aa14216d87298aaf6de82b5
SHA1

f4ff436b40319e317bb022c97ea6b5a24a87486c
SHA256

9bacbe6aa854abb9a0f8bfda9692e0f39f910c050158444f4eada541764abc19
SHA512

509a656d2bddc8871826cba1c932597b6d9232aef8a65d96b9191b7b1e5e9bafb32832b709ad7bcb80c630ae7a8b1578e6f5441a51f3cce40270326d07db3e61
SSDEEP

384:x9OFjwW3eBW80Whv3LSc67O1Hi6Tbg1N+iqJLL8V1hwHoLKZ/hNYQgA:TiX3l808Lg74HJmNTgUVDwZyQg

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\RemoteDbg.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\RemoteDbg.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	5048	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5048	rundll32.exe
5048	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 5048	2376	rundll32.exe	81
PID 2376 wrote to memory of 5048	2376	rundll32.exe	81
PID 2376 wrote to memory of 5048	2376	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bacbe6aa854abb9a0f8bfda9692e0f39f910c050158444f4eada541764abc19.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9bacbe6aa854abb9a0f8bfda9692e0f39f910c050158444f4eada541764abc19.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 648
    3⤵
    - Program crash
    PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5048 -ip 5048
1⤵
PID:3032

memory/5048-133-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download