db333be4247b3cef1efefe762327112ca465de58a15a260033d03a7aaaf5cbb2

Analysis

max time kernel
83s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2022, 23:20

Target
deskmon.dat.dll
Size 1.0MB
Sample221219-3bd9vabd9v
SHA256 db333be4247b3cef1efefe762327112ca465de58a15a260033d03a7aaaf5cbb2
MD5 11297f4082e4c4b60e8b3ba6d35c2d52
SHA1 d4bfbe9a6df9a9b412e3690a68b5c4fca44d321c
SHA512 7288352c080399257369613b2435ceafaa7a39769655d5c42b719fb65dfed62326fd3e42248a3b0e4c825c73b75235d9bd7d61b80c78bb0d244d1cc34afa12ae
SSDEEP 24576:Dxjz/fW1fil8KupGavkg3NyY+bbTNYIBAUZLYnTwFU0s:FXOg8KupGaXXEYIBAUZLYngx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4392	4896	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4896	4964	rundll32.exe	80
PID 4964 wrote to memory of 4896	4964	rundll32.exe	80
PID 4964 wrote to memory of 4896	4964	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\deskmon.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\deskmon.dat.dll,#1
  2⤵
  PID:4896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 600
    3⤵
    - Program crash
    PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4896 -ip 4896
1⤵
PID:3044