bc7f77e5ced81f9dfe0137f95966393ea8c0a6ff6656dd65fcb7b9accf94e9fb

Analysis

max time kernel
116s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2023, 19:24

Target

Malicious_bc7f77e5ced81f9dfe0137f95966393ea8c0a6ff6656dd65fcb7b9accf94e9fb.dll
Size

105KB
MD5

1356cc3cfabaa408ad0324e7297d05e9
SHA1

99d38aebe64f0b936e25abcedbc6d1500a42414d
SHA256

bc7f77e5ced81f9dfe0137f95966393ea8c0a6ff6656dd65fcb7b9accf94e9fb
SHA512

f09654a2573e429eaa9e211e39e5e0136846877ab366965e7865b0634cae859b3da7de39eafe03ccfbd9d22a0e7077fb7789abe44e2991656a2dd04ae4e1339b
SSDEEP

1536:RAjY1872HkwP9Vsu0x/hxInFnW2/D6tUAYzs8jcdoMU1MQEBuSpe7TRgJjE6:RAIL0dhxIdWOaoMU2zuEe7TRgJj9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4760	1596	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1596	rundll32.exe
1596	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 1596	3980	rundll32.exe	82
PID 3980 wrote to memory of 1596	3980	rundll32.exe	82
PID 3980 wrote to memory of 1596	3980	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Malicious_bc7f77e5ced81f9dfe0137f95966393ea8c0a6ff6656dd65fcb7b9accf94e9fb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Malicious_bc7f77e5ced81f9dfe0137f95966393ea8c0a6ff6656dd65fcb7b9accf94e9fb.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 572
    3⤵
    - Program crash
    PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1596 -ip 1596
1⤵
PID:4940