7783fb922abee77ebc12618187fe164cf8beecbedf4e8e91ad08434ccacc929b

Resubmissions

19/04/2023, 15:23

19/04/2023, 13:39

max time kernel
100s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2023, 15:23

Target

b0r1sCantMakeUphisMind.dll
Size

977KB
MD5

57a01187097a9f0bc4bbb77a50f9d9f8
SHA1

576463418b6813334b58a0dc19c2aa05bc3cea91
SHA256

7783fb922abee77ebc12618187fe164cf8beecbedf4e8e91ad08434ccacc929b
SHA512

6a7d740e0da849b8ab720e097cc5052ab12af47b2e79687e22edf8cae2115d6bfc9078d9fc4ccc4efe6e8c9703783ae8420ed49a5476f72dbdb3c1173c801bd8
SSDEEP

12288:dIAETyZizswDZr2rnVed8b2NFCKh6RaG7EeDATbURJTdL7K2Lzla:dI3AwDj02Nlh6IG7EeYU7TVW2Lzla

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4696	4408	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 396 wrote to memory of 3420	396	rundll32.exe	85
PID 396 wrote to memory of 3420	396	rundll32.exe	85
PID 396 wrote to memory of 3420	396	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0r1sCantMakeUphisMind.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b0r1sCantMakeUphisMind.dll,#1
  2⤵
  PID:3420

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 480 -p 4408 -ip 4408
1⤵
PID:3352

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4408 -s 1756
1⤵
- Program crash
PID:4696