974c71eeabcf4112e5b8426c6411cadd5bf6d9b6000c342c69d11be898481649

Resubmissions

16/06/2023, 16:16

16/06/2023, 15:59

max time kernel
87s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2023, 15:59

Target
threatenedNeuromastic.dll
Size 2.1MB
Sample230616-te8s7afd8s
SHA256 974c71eeabcf4112e5b8426c6411cadd5bf6d9b6000c342c69d11be898481649
MD5 766fa541d13961e0ab3f2b0d61ef49aa
SHA1 bbebd4b9e6ec0095fb6dc13bcaf04338c7bcad4a
SHA512 6f4865bcb38f0e622a0cf25beb9d7ed724b6924289a479bbafbcf4bafb08ecd5251f8444ef861acb5615c4544f24bf2a0842e09e47fb76811cbe1830305b93fd
SSDEEP 49152:/jz3HgNzPVQ4FzdB5fYCjMiC2uH+QjaE6j+l/ZZvmu2dxMgLiv:7gZo2uHrJ6e/Z9QdxMIi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1868	1448	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 1448	3216	rundll32.exe	83
PID 3216 wrote to memory of 1448	3216	rundll32.exe	83
PID 3216 wrote to memory of 1448	3216	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\threatenedNeuromastic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\threatenedNeuromastic.dll,#1
  2⤵
  PID:1448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 676
    3⤵
    - Program crash
    PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1448 -ip 1448
1⤵
PID:4624