12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
440s
max time network
455s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02-08-2023 23:39

Target

Common Files/CtrlEx.dll
Size

44KB
MD5

d22986b4c4b4bab0da6be8f68fe952be
SHA1

6b98e89efcde94ac5917b333f2f6bd46ddaf8ead
SHA256

9d2bd8bcb35be07fd17a2b3fba3c543acf3a470c853ad9bae6e3b7f587eea739
SHA512

f731cba7dcee6bcbf4cb8a286db726a3a3a21bdca18a4f196942696e25d931d8c18eba55c497a3d31a5ab592bed817bda290d301d103a1acdd5717ac3ad5afd3
SSDEEP

384:wsflfkZf6fGAeib1uwMX7nVgWCoxXBZ74mG+4B91Ky8IZv:wdf6fGADb1uFny9oxvyvZv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3048	5080	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 5080	4056	rundll32.exe	81
PID 4056 wrote to memory of 5080	4056	rundll32.exe	81
PID 4056 wrote to memory of 5080	4056	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\CtrlEx.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\CtrlEx.dll",#1
  2⤵
  PID:5080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 684
    3⤵
    - Program crash
    PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5080 -ip 5080
1⤵
PID:2268

memory/5080-133-0x00000000003E0000-0x00000000003FE000-memory.dmp

Filesize
120KB

Download
memory/5080-135-0x0000000000830000-0x000000000086E000-memory.dmp

Filesize
248KB

Download
memory/5080-137-0x0000000000870000-0x0000000000889000-memory.dmp

Filesize
100KB

Download
memory/5080-138-0x00000000008A0000-0x00000000008CF000-memory.dmp

Filesize
188KB

Download
memory/5080-140-0x0000000002600000-0x0000000002C09000-memory.dmp

Filesize
6.0MB

Download
memory/5080-141-0x0000000002020000-0x00000000025F9000-memory.dmp

Filesize
5.8MB

Download
memory/5080-144-0x00000000008F0000-0x00000000008FD000-memory.dmp

Filesize
52KB

Download