ed9e031361d49d4507191e7279f2862290d9e3894c4dff4a0776be1e19f1c4d7

Analysis

max time kernel
91s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2023, 11:54

Target

Friendlily.Allineate.dll
Size

917KB
MD5

27dadd5abdbb4c80da96453920d15c93
SHA1

302444ecd032ca1d3e06fad76a4723dbe89e8fe8
SHA256

ed9e031361d49d4507191e7279f2862290d9e3894c4dff4a0776be1e19f1c4d7
SHA512

bdd0f516212e7d9f12e695e42312827399896df41aac0fa235d901128db4290a4d1dc275d696634b61f2da0b1564337b6c3cdd5162399ab4c7e2a44c0c72a17d
SSDEEP

24576:xHA2XMYABs772W/8vLj/9sgR+OVnh8gt42vCkzeztwPOfQWyBZPPdhbBF91Xe9a:FMYABC8vLj/2jA8gxZPPdhbBP1O9a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1660	4124	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4124	4996	rundll32.exe	82
PID 4996 wrote to memory of 4124	4996	rundll32.exe	82
PID 4996 wrote to memory of 4124	4996	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Friendlily.Allineate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Friendlily.Allineate.dll,#1
  2⤵
  PID:4124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 596
    3⤵
    - Program crash
    PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4124 -ip 4124
1⤵
PID:1556