d6fab519a37cf97a3bf27199d8256ecc6e93259c76bb17be949003dd149641e3

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2023, 19:24

Target

Malicious_d6fab519a37cf97a3bf27199d8256ecc6e93259c76bb17be949003dd149641e3.dll
Size

105KB
MD5

db77672c114add499dbc2cbba2ed0967
SHA1

3cfdeb96edb7f248850cc54f613a1f68de2ca2e1
SHA256

d6fab519a37cf97a3bf27199d8256ecc6e93259c76bb17be949003dd149641e3
SHA512

beaa8fe3a4ada529d96c663c6d3cfa33d8bd30d22191a380611b7ccc2848fa67b43bf122df9e6d6847b46c9382409f01e41620c01ff8e760ee05d9d588ece9f6
SSDEEP

1536:yAjY1872HkwP9Vsu0x/hxInFnW2/D6tUAYzs8jcdoMU1MQEBuSpS7TRgld:yAIL0dhxIdWOaoMU2zuES7TRgz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
60	1188	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1188	rundll32.exe
1188	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 1188	5104	rundll32.exe	85
PID 5104 wrote to memory of 1188	5104	rundll32.exe	85
PID 5104 wrote to memory of 1188	5104	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Malicious_d6fab519a37cf97a3bf27199d8256ecc6e93259c76bb17be949003dd149641e3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Malicious_d6fab519a37cf97a3bf27199d8256ecc6e93259c76bb17be949003dd149641e3.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 600
    3⤵
    - Program crash
    PID:60

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1188 -ip 1188
1⤵
PID:4836