173b14b1b579add43d7434822a7513d175167c22a1cc50d8e84c63bcb9e5d572

Analysis

max time kernel
380s
max time network
617s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
17-01-2023 18:49

Target

b.dll
Size

60KB
MD5

5359ac968f7cee07ee5b28e4f77e0a9b
SHA1

4488d17610c128cf2caf2dd27dce5767c68a10b4
SHA256

173b14b1b579add43d7434822a7513d175167c22a1cc50d8e84c63bcb9e5d572
SHA512

983db64d91d8e80899ad28b56087af8912943d2f7517db7cde9209c7d168460ba26050ce691a492e36e9a112416bce644414fa7d316594af90b3c3d1d2bb1cc3
SSDEEP

768:hO4apg9TJD/UFPvh45g1WmxValWf5uJMj9TX8Tlpd76o1x6:hHT+4mjw4OdZx

Score

3^/10

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2708	2404	WerFault.exe	65
4252	4984	WerFault.exe	73
4064	5032	WerFault.exe	74

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4984	4940	cmd.exe	73
PID 4940 wrote to memory of 4984	4940	cmd.exe	73
PID 4940 wrote to memory of 5032	4940	cmd.exe	74
PID 4940 wrote to memory of 5032	4940	cmd.exe	74

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b.dll,#1
1⤵
PID:2404
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2404 -s 220
  2⤵
  - Program crash
  PID:2708

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\system32\regsvr32.exe
  regsvr32 b.dll
  2⤵
  PID:4984
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4984 -s 380
    3⤵
    - Program crash
    PID:4252
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s b.dll
  2⤵
  PID:5032
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 5032 -s 380
    3⤵
    - Program crash
    PID:4064