79476a3ef7ad7f762ef44b665e32994c20e331a459c73556939dd20ca4aeb1f7

Analysis

max time kernel
508s
max time network
573s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 12:32

Target

UpOneLevel/StuffItConnect.dll
Size

81KB
MD5

9f499cb83be4c828383e70b8b94a6479
SHA1

915a055b761e713d144edc7b7b94d8783f28d485
SHA256

a059228a9c6e656877adbb8d764523a02634ec8c95a8057c059b414e2a4c14e1
SHA512

4b6849f7e2f094f2d208f3dad823a86288970d500a827d31addd6eb81674d2e6be6ad1e75e488ad9b61c08db5d9351188e00d09363fc695e2f8534746a6bbbcc
SSDEEP

1536:EGmRhB/Qrnkz929g/QIZjvjfVJouxULhcLFV5IKebW9sG0OKU20Wz8MJH:pmRSAlBohcLFV5IKea9s1OKqWz8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4300	4800	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4800	1276	rundll32.exe	85
PID 1276 wrote to memory of 4800	1276	rundll32.exe	85
PID 1276 wrote to memory of 4800	1276	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\UpOneLevel\StuffItConnect.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\UpOneLevel\StuffItConnect.dll,#1
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 636
    3⤵
    - Program crash
    PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4800 -ip 4800
1⤵
PID:4128