3f504f7015e51873898235bfac8108d2ea29cdb2dec27c76dd42395316e8ffb0

Resubmissions

01/06/2023, 22:52

01/06/2023, 22:46

max time kernel
384s
max time network
389s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/06/2023, 22:46

Target

Paint tool Sai Angel Drawin/Paint Tool SAI/sfl.dll
Size

488KB
MD5

3156c1ddae3728dca1d103a5e92abbd7
SHA1

4b5a1e10e8bd97001d8bb3dad5f6d7c1831c9a78
SHA256

20e7cf5b16f1898844d1aa38c247e0d84482763616f6d17998c6d9ce63e4d927
SHA512

0fad1b70b7365db5d301e3cda9597f351d2c9adfe68f656e4ab314a718a48a3a509b404a54124151c4d905286a5f93643f4e9b6944790362773f92b802e8c444
SSDEEP

3072:z+bd1pjbJj9KkWqUyGHlIRPMNjC1vlIIrwgQ31HFRb:WHXKVq8I9M89lBry31

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	1984	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 1984	324	rundll32.exe	27
PID 324 wrote to memory of 1984	324	rundll32.exe	27
PID 324 wrote to memory of 1984	324	rundll32.exe	27
PID 324 wrote to memory of 1984	324	rundll32.exe	27
PID 324 wrote to memory of 1984	324	rundll32.exe	27
PID 324 wrote to memory of 1984	324	rundll32.exe	27
PID 324 wrote to memory of 1984	324	rundll32.exe	27
PID 1984 wrote to memory of 1980	1984	rundll32.exe	28
PID 1984 wrote to memory of 1980	1984	rundll32.exe	28
PID 1984 wrote to memory of 1980	1984	rundll32.exe	28
PID 1984 wrote to memory of 1980	1984	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Paint tool Sai Angel Drawin\Paint Tool SAI\sfl.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Paint tool Sai Angel Drawin\Paint Tool SAI\sfl.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 228
    3⤵
    - Program crash
    PID:1980