6a67e05969f04dd8fe1bd622f7119acf118edfb57276b7eea17f5613e4325c38

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 22:38

Target

UsNZh.dll
Size

318KB
MD5

be07246414f007b836fca7dc36958aa5
SHA1

ddc327192d26d9152c4fe1268a8c75e504c57600
SHA256

6a67e05969f04dd8fe1bd622f7119acf118edfb57276b7eea17f5613e4325c38
SHA512

518c285bf4a2ab0595df705f534207d4008b33f907766ecc1b86f00c20229de1221f28c62314e22f2907f09e3d6f19b351f5528c54d7141bfacd9c9f9e2a2adc
SSDEEP

6144:NaaVzaA4R+aU/P/IvTDp3ZZ99GSrtMhsNW9TUW/aSFGMReiDhKRIbGjZneB6ncqp:m+aU/P/IvTDp3ZZ99RrtyU2GSYIajfnz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3084	4456	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 4456	3092	rundll32.exe	86
PID 3092 wrote to memory of 4456	3092	rundll32.exe	86
PID 3092 wrote to memory of 4456	3092	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UsNZh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\UsNZh.dll,#1
  2⤵
  PID:4456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 596
    3⤵
    - Program crash
    PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4456 -ip 4456
1⤵
PID:672