367431aedd9a55973bc16002ade0f4ca8216054c9e0aa85e58f8902e6b6c16d3

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2023, 04:10

Target

367431aedd9a55973bc16002ade0f4ca8216054c9e0aa85e58f8902e6b6c16d3.dll
Size

2.6MB
MD5

ce5e9c83d87650889b4c4d89b19d5822
SHA1

d609604067849eb0b08352bb267d85f24768c982
SHA256

367431aedd9a55973bc16002ade0f4ca8216054c9e0aa85e58f8902e6b6c16d3
SHA512

49b2db1f74fd17b8722fe1fb7b91a056f8e7f29886652e8c87813229904de688cf46120616f14d809e89aedf1f474c59c8eb1a83e277d7263e3ab32037adf810
SSDEEP

49152:vpbTRYULot5NuMRlMPnn4uuCM88/OxuIsXrWJtG0k2+4FajUhCeVscG:RhZ2X3R2n4zCTJsqzGF4P96

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1116	5068	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5068	rundll32.exe
5068	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 5068	5084	rundll32.exe	82
PID 5084 wrote to memory of 5068	5084	rundll32.exe	82
PID 5084 wrote to memory of 5068	5084	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\367431aedd9a55973bc16002ade0f4ca8216054c9e0aa85e58f8902e6b6c16d3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\367431aedd9a55973bc16002ade0f4ca8216054c9e0aa85e58f8902e6b6c16d3.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 832
    3⤵
    - Program crash
    PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5068 -ip 5068
1⤵
PID:1596

memory/5068-133-0x0000000074B20000-0x0000000075019000-memory.dmp

Filesize
5.0MB

Download
memory/5068-137-0x0000000074B20000-0x0000000075019000-memory.dmp

Filesize
5.0MB

Download
memory/5068-138-0x0000000074B20000-0x0000000075019000-memory.dmp

Filesize
5.0MB

Download
memory/5068-139-0x0000000002D20000-0x0000000002DB4000-memory.dmp

Filesize
592KB

Download
memory/5068-140-0x0000000004020000-0x0000000004094000-memory.dmp

Filesize
464KB

Download
memory/5068-141-0x0000000004230000-0x000000000423F000-memory.dmp

Filesize
60KB

Download
memory/5068-142-0x0000000004240000-0x00000000042F9000-memory.dmp

Filesize
740KB

Download
memory/5068-143-0x0000000004300000-0x000000000439B000-memory.dmp

Filesize
620KB

Download
memory/5068-144-0x00000000043A0000-0x000000000461E000-memory.dmp

Filesize
2.5MB

Download
memory/5068-145-0x0000000074B20000-0x0000000075019000-memory.dmp

Filesize
5.0MB

Download