018f22c7760b32d5d936d02cb62df9bb29242ed2c1820385844cb751f4425d61

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2023, 13:34

Target

SecuriteInfo.com.Win32.PWSX-gen.31947.dll
Size

77KB
MD5

bee196a3b95f6e1a6eb37c56b41bc271
SHA1

fff29a2baa7eb4a8b784140071275863b6ae3c61
SHA256

018f22c7760b32d5d936d02cb62df9bb29242ed2c1820385844cb751f4425d61
SHA512

de2c39610ff1d3bc25449bc56647af59d782296eb9374aa2a2fd3a43beb118a8350d34aa1d5256f39671c7bb74eceae4788739835278337a153232a5540bc6af
SSDEEP

1536:lHvsoKpy9d0dJSgwXdt7iWkrS9GA6Fp/lNuOsW4cdbW/YER:ODxdQ5dfkrVdMKb6R

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4116	4696	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 4696	1232	rundll32.exe	84
PID 1232 wrote to memory of 4696	1232	rundll32.exe	84
PID 1232 wrote to memory of 4696	1232	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.31947.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.31947.dll,#1
  2⤵
  PID:4696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 676
    3⤵
    - Program crash
    PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4696 -ip 4696
1⤵
PID:4392