3f504f7015e51873898235bfac8108d2ea29cdb2dec27c76dd42395316e8ffb0

Resubmissions

01/06/2023, 22:52

01/06/2023, 22:46

max time kernel
476s
max time network
481s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2023, 22:46

Target

Paint tool Sai Angel Drawin/Paint Tool SAI/sfl.dll
Size

488KB
MD5

3156c1ddae3728dca1d103a5e92abbd7
SHA1

4b5a1e10e8bd97001d8bb3dad5f6d7c1831c9a78
SHA256

20e7cf5b16f1898844d1aa38c247e0d84482763616f6d17998c6d9ce63e4d927
SHA512

0fad1b70b7365db5d301e3cda9597f351d2c9adfe68f656e4ab314a718a48a3a509b404a54124151c4d905286a5f93643f4e9b6944790362773f92b802e8c444
SSDEEP

3072:z+bd1pjbJj9KkWqUyGHlIRPMNjC1vlIIrwgQ31HFRb:WHXKVq8I9M89lBry31

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4128	3736	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 3736	4308	rundll32.exe	83
PID 4308 wrote to memory of 3736	4308	rundll32.exe	83
PID 4308 wrote to memory of 3736	4308	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Paint tool Sai Angel Drawin\Paint Tool SAI\sfl.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Paint tool Sai Angel Drawin\Paint Tool SAI\sfl.dll",#1
  2⤵
  PID:3736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 612
    3⤵
    - Program crash
    PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3736 -ip 3736
1⤵
PID:2084