fe310af46190858dd9b851e44dc3cb236093f0d5b5b40594f279c6cd824482a9

Resubmissions

15/06/2023, 13:15

15/06/2023, 13:09

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2023, 13:15

Target
0.4103157223560945.dll
Size 246KB
Sample230615-qhf1sshc6w
SHA256 fe310af46190858dd9b851e44dc3cb236093f0d5b5b40594f279c6cd824482a9
MD5 037b8c0233524810844336d227c1a426
SHA1 a1a40f4c2dd43eb8aa7d900e0071e907804d181c
SHA512 b0d23d0ad0a5236c421ba13f785cab8070e9cf38b2fac82abf6f0696a46050546e1cde7a6f864bfba613252ed5b4506ae5a5330bcdfc4638ec6fdb8ef4379951
SSDEEP 6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1TzL:cRwBEZp11EFcUTzL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4628	3176	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3176	2368	rundll32.exe	82
PID 2368 wrote to memory of 3176	2368	rundll32.exe	82
PID 2368 wrote to memory of 3176	2368	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0.4103157223560945.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0.4103157223560945.dll,#1
  2⤵
  PID:3176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 600
    3⤵
    - Program crash
    PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3176 -ip 3176
1⤵
PID:3824

memory/3176-133-0x00000000647C0000-0x0000000064802000-memory.dmp

Download