3c90b3d32f3fe37632edfad2b768cf77d70e7de0d3291d0e5274ea8a7dc69141

Analysis

max time kernel
175s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2023, 19:44

Target

Slither x32y 64/nw.dll
Size

68.0MB
MD5

4095865a5658450bb415dcbe4d854580
SHA1

6ffba25849a6a6c0df63f89653a4d79c3c553815
SHA256

a43a6dbebbea327dd5a64f051ce27b4e24cf66c7213a1de7f3a357e380c68f45
SHA512

60b2e139469e534c886b133a6fa1ad5280d29e7ffc070f169971b9619536c18da41e4bb9c048a83dd39aa421590745a909f7717c4847120be460e672a32e2183
SSDEEP

1572864:RuCwol9s/loA881aY2p6ab63gs9rHEfSoMmZMzbe75lgCSBbe8fAUTJ:RuKOhkk97EZMmZMzbe7ECk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3108	5016	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 5016	4388	rundll32.exe	79
PID 4388 wrote to memory of 5016	4388	rundll32.exe	79
PID 4388 wrote to memory of 5016	4388	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\nw.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Slither x32y 64\nw.dll",#1
  2⤵
  PID:5016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 696
    3⤵
    - Program crash
    PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5016 -ip 5016
1⤵
PID:5092