cbf5c51ba26fc8fb53b25faef5748a7e13c5ebc39c0a1f2c00c1644469b9fcbc

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2023, 21:26

Target

Delta V3.56/bin/587.dll
Size

5.6MB
MD5

0687a42a8d9a45e9c994d7d569f003b9
SHA1

10edcbf55f0deb7ae78d8b444a310d3ae9dd3a59
SHA256

08b60a3a4842be193fed29bd1da35a3897d91e17c03efff412c0754a58582e05
SHA512

5bdeef33f6bffdacb5fe169e61a4e19426e397674dc87cf76b506d616a640af272edba2076f13ffab6b392443e2cfdb34b972b311467a8b5bfe4da05b89368c9
SSDEEP

98304:6T99SNZb8g2YdvpgFxg2BdtVQTE6DSe6sqckGOeHC2E0o4QzrxdhfrNpqJXzT1tw:6h9m9vlyTd0SRsq0Oyo40/VfqPt4xZl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3792	2908	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 2908	548	rundll32.exe	85
PID 548 wrote to memory of 2908	548	rundll32.exe	85
PID 548 wrote to memory of 2908	548	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Delta V3.56\bin\587.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Delta V3.56\bin\587.dll",#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 732
    3⤵
    - Program crash
    PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2908 -ip 2908
1⤵
PID:4972

memory/2908-133-0x0000000074490000-0x0000000075198000-memory.dmp

Filesize
13.0MB

Download
memory/2908-136-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download