4e62e16a2809fe5cd45d5d5f97a80088825119ec77f39e92c18c826892df282a

Analysis

max time kernel
120s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 22:07

Target

4e62e16a2809fe5cd45d5d5f97a80088825119ec77f39e92c18c826892df282a.dll
Size

2.4MB
MD5

b8aca45c75b69fa4dd2c591ec09402a9
SHA1

5408f0dd6210c09ed1a97a92db16869d1ae0473e
SHA256

4e62e16a2809fe5cd45d5d5f97a80088825119ec77f39e92c18c826892df282a
SHA512

cface80db8bc0d93b79b2ae01c540eeeb3ce21efe45abcd1fed9e7561b58b0b47cf59828e747ceb35116e8abf75210e36c49a534b16ea27504f7efac0330503e
SSDEEP

49152:llgpgzE7lZn07+0m/tOVJYKRJOP27Nr9rmiURhpHnqykN/VYz:llgpUE7rneRatWJYUf7NrnURnnqy

Score

4^/10

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\SmartWBInput\SmartCloudWB.ini	rundll32.exe
File opened for modification	C:\Program Files (x86)\SmartWBInput\1.6.1.11106\SmartCloudWBInfo.ini	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
632	4536	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 4536	2452	rundll32.exe	85
PID 2452 wrote to memory of 4536	2452	rundll32.exe	85
PID 2452 wrote to memory of 4536	2452	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e62e16a2809fe5cd45d5d5f97a80088825119ec77f39e92c18c826892df282a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4e62e16a2809fe5cd45d5d5f97a80088825119ec77f39e92c18c826892df282a.dll,#1
  2⤵
  - Drops file in Program Files directory
  PID:4536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 804
    3⤵
    - Program crash
    PID:632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4536 -ip 4536
1⤵
PID:1092