55f9eb353d7a527815d69ea986d8994d4411863fe1ba924bb7d5df9cca4c707f

Analysis

max time kernel
142s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/08/2023, 09:57

Target

55f9eb353d7a527815d69ea986d8994d4411863fe1ba924bb7d5df9cca4c707f.dll
Size

112KB
MD5

2f0bd50e498e98d509b643acc135fc47
SHA1

ee507e6ecd48a14aa53bd3d6de90331691e6dfb3
SHA256

55f9eb353d7a527815d69ea986d8994d4411863fe1ba924bb7d5df9cca4c707f
SHA512

40d6717666aef47636c3212afebbd62c46887e4f3612a9543a5f2955048e5fe6ba080375b859d05c646954590d605b7c452c7792e697676739725932e9a09c21
SSDEEP

1536:EE1COUfSma1R+TTd/0Y/1TMdmdRf+7FioDGkvSKoGpDNVswV:EE1COUqn1e1QdURG51i4joGpRVswV

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 948 set thread context of 4120	948	rundll32.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4020	4120	WerFault.exe	86

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 948	1520	rundll32.exe	84
PID 1520 wrote to memory of 948	1520	rundll32.exe	84
PID 1520 wrote to memory of 948	1520	rundll32.exe	84
PID 948 wrote to memory of 4120	948	rundll32.exe	86
PID 948 wrote to memory of 4120	948	rundll32.exe	86
PID 948 wrote to memory of 4120	948	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55f9eb353d7a527815d69ea986d8994d4411863fe1ba924bb7d5df9cca4c707f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55f9eb353d7a527815d69ea986d8994d4411863fe1ba924bb7d5df9cca4c707f.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\system32\notepad.exe"
    3⤵
    PID:4120
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 348
      4⤵
      Program crash
      PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4120 -ip 4120
1⤵
PID:1316