784a2827b5ddc82e69198aa9f6a5382c32716eb0263bc2a4f6fc500589c8a3ef

Analysis

max time kernel
5s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2022 16:22

Target

Contract.sm.dll
Size

516KB
MD5

9f6ec22b24f100366d83dfe499e5bd3e
SHA1

bce43420d7bcf48ca3f99707feea8e55d454195b
SHA256

784a2827b5ddc82e69198aa9f6a5382c32716eb0263bc2a4f6fc500589c8a3ef
SHA512

926c3d1b160a8d76075dfa1f4c2eb3447f02fe0fe019c5949ab20c2f2940f2079ff1aa6afafa4cdebedb7783a5004b1a688b43a5cf5b9451146a324fc7e49469
SSDEEP

6144:wiIqnct7uycRpLrFPQleGc2BpeQvfTiD3MJIyFX+OwjzK9y9KOc6rXPMATcBu:wihnctArBgRprvbiIIAuz19nTMAgc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	1588	WerFault.exe	75

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1588	2228	rundll32.exe	75
PID 2228 wrote to memory of 1588	2228	rundll32.exe	75
PID 2228 wrote to memory of 1588	2228	rundll32.exe	75

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Contract.sm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Contract.sm.dll,#1
  2⤵
  PID:1588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 600
    3⤵
    - Program crash
    PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1588 -ip 1588
1⤵
PID:2656