f9423924822a969c410e8499091cbf81e2c5f1574259ef840b52d2698018169f

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-07-2023 02:29

Target

SecuriteInfo.com.Win32.PWSX-gen.24382.12556.dll
Size

11KB
MD5

69a949fce10c6f4a7e1a81b8491d1b58
SHA1

ac90035678d358817c812baf959d1acabd8204f8
SHA256

f9423924822a969c410e8499091cbf81e2c5f1574259ef840b52d2698018169f
SHA512

2e2d85b16bde0b054f7bc88e65ae7664f6a103e55aef0a3dda3e49e4a3021ca96a0b24cd980f27810c84e83f62ad8c198c32a4eafff990138bf4c7a3febed4bd
SSDEEP

96:MUKdtz7+bq4LeQXcDY4c5JatcRGdfrUfTtXiAlVO0a7gsiL+PC41tuX88zC9Ad3T:9IZ7OpTGdoTtXiA3/OC89Gth/NvAcw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	1596	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1596	1368	rundll32.exe	84
PID 1368 wrote to memory of 1596	1368	rundll32.exe	84
PID 1368 wrote to memory of 1596	1368	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24382.12556.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.24382.12556.dll,#1
  2⤵
  PID:1596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 656
    3⤵
    - Program crash
    PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1596 -ip 1596
1⤵
PID:1636