99f85b6ed0ef6aabfa64727992c2d6dc3564dc49ebdb4a11a9647aeb32067544

Analysis

max time kernel
249s
max time network
263s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2023, 18:47

Target

mainlibr.dll
Size

2.5MB
MD5

deb5ebc2a3a6f776cfed0afb7b350a9b
SHA1

28615bc9fa2077b3597415a76a55f7775e0c8007
SHA256

8c81c84548ce191b11390ebaa71397d23662593b1c113aaa0392e40ff0f9307a
SHA512

5765c54147c8b950c594619d03b3a154e94aa43ce39ca91831b39229049794e6f6ee8226ebe4367c27b1d40409d6f9feaad2f8fa1a9d42a777b9df88fb6e5711
SSDEEP

49152:Ld0krhjbVYU9U/ElyrLKlvGBO58GBjG9nYM6JBe4PjnhMsQHNClhIdYTf2O+yX37:ykrRyylvGB65YNCMghMtHIledkp+R

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3744	1720	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1720	1980	rundll32.exe	81
PID 1980 wrote to memory of 1720	1980	rundll32.exe	81
PID 1980 wrote to memory of 1720	1980	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mainlibr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mainlibr.dll,#1
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 616
    3⤵
    - Program crash
    PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1720 -ip 1720
1⤵
PID:1472