12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
436s
max time network
459s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02-08-2023 23:39

Target

Common Files/Appliance.dll
Size

80KB
MD5

bba8f3421553805b378f452dffb365c8
SHA1

4b1de7056ce163f5ef813bd00a2eb41aece0a646
SHA256

476f6241542e7a881dcc09aa313d3582fcc7c28ba1c33314fe5f094277b6116b
SHA512

14e59305d0b54e5714680065f0fa5b574fe39e2e7ab9d1602f4a2656a4abb2caf0df919476b8c760993ff2ecbf8f645c7e123667816246e4bf3d27cface679f9
SSDEEP

768:QcXnH5UAIts51rvqIjqAyoyTTitBXoQx3ALHo1GNlBLlZCDs+sed0RaImDuWfUKq:bZbIudtqToyTTUYKt0RnC7s5FwuWDLC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1060	2420	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2420	4460	rundll32.exe	85
PID 4460 wrote to memory of 2420	4460	rundll32.exe	85
PID 4460 wrote to memory of 2420	4460	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Appliance.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\Appliance.dll",#1
  2⤵
  PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 620
    3⤵
    - Program crash
    PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2420 -ip 2420
1⤵
PID:3344