6372927c368b79c065c445ed58617dc9e60975d3fd94b177bd4e10e01694bd2b

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2023, 02:09

Target
74ee45a7dc4ca40eaaf817dc5959328d.dll
Size 829KB
Sample230314-ck4yrach45
SHA256 6372927c368b79c065c445ed58617dc9e60975d3fd94b177bd4e10e01694bd2b
MD5 74ee45a7dc4ca40eaaf817dc5959328d
SHA1 c8bc4d48f0e28dc61d65b4f8e6c0845387e2c44c
SHA512 685b91f279fcf8b7d2d8ab1865d79146cc0ae47d1a8e3839959b1964ade6e43e7a975ed50b075f463d8fa6aa45ca7f655f1f75f27ca7c6e15a8cf143b4f0e729
SSDEEP 24576:3jfkq3uw3cJg1ZBXJPnSiM/wyRAH5pdlTE:Dkq3nci1Z7/SZwfVE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
444	4656	WerFault.exe	85

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4656	2800	rundll32.exe	85
PID 2800 wrote to memory of 4656	2800	rundll32.exe	85
PID 2800 wrote to memory of 4656	2800	rundll32.exe	85
PID 4428 wrote to memory of 3036	4428	cmd.exe	103
PID 4428 wrote to memory of 3036	4428	cmd.exe	103

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\74ee45a7dc4ca40eaaf817dc5959328d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\74ee45a7dc4ca40eaaf817dc5959328d.dll,#1
  2⤵
  PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 648
    3⤵
    - Program crash
    PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4656 -ip 4656
1⤵
PID:4620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3336

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Windows\system32\rundll32.exe
  rundll32 74ee45a7dc4ca40eaaf817dc5959328d.dll,XS88
  2⤵
  PID:3036