2c21ca7f232beffd48a26b0efb80cbbe93345184f29eee2cf175c73d6822c204

Analysis

max time kernel
128s
max time network
254s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2023, 19:52

Target

KRNLWRD/krnl.dll
Size

3.6MB
MD5

fc60421668db13abf48ba5465e3ab495
SHA1

6b13d1a54e8b48202e21f67216ca67b7bc4df2d2
SHA256

a03e2456d3464bbfecd36969db85c24d313d6e5fb033861112f477e81373768b
SHA512

0a1de5cfd2599171036a365cf86ce421215dc7883012080cc65161935e9dc4b6e4a2b6176cf7239755c2fc85c39c0269fea054c0db5906df7b7f36d655a4d9e5
SSDEEP

49152:hkNojQZIux3HiL0d1iHMb/6ThRaIg1YYy1Oj7HqEawQrrrtBVi0EESW/JedjXwfs:5Xux3qI1isbSThRab1bymaj/LoEV0hy

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3896	4284	WerFault.exe	84
400	4284	WerFault.exe	84

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4284	rundll32.exe
4284	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4284	4672	rundll32.exe	84
PID 4672 wrote to memory of 4284	4672	rundll32.exe	84
PID 4672 wrote to memory of 4284	4672	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KRNLWRD\krnl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KRNLWRD\krnl.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 620
    3⤵
    - Program crash
    PID:3896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 568
    3⤵
    - Program crash
    PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4284 -ip 4284
1⤵
PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4284 -ip 4284
1⤵
PID:3368

memory/4284-133-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/4284-134-0x0000000074E60000-0x00000000756AB000-memory.dmp

Filesize
8.3MB

Download