290538f26668edcb88c85e02ee5302f6cfc32ad808016d1a39b4775cab376a8b

Analysis

max time kernel
140s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2023, 07:31

Target

SecuriteInfo.com.Win32.PWSX-gen.20451.3420.dll
Size

11KB
MD5

2b78b8d4e6201e03a165a83aef558ed7
SHA1

fdfbe52987e59e49a3360fa84a22c67b63331676
SHA256

290538f26668edcb88c85e02ee5302f6cfc32ad808016d1a39b4775cab376a8b
SHA512

e32facd14d8c29ba22f28acda5799b168185b829d887e24eaceaffc70a1c10077a9d4607edac5eb480dad913f2815277dac8a466bc1db38288bc0a63a7b018ac
SSDEEP

192:lTdoFSrxLurGrTvMkrBFnowz+bq3/vXT+z:lTmFSfrbMkV5z+be3T+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5116	2604	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2604	2084	rundll32.exe	82
PID 2084 wrote to memory of 2604	2084	rundll32.exe	82
PID 2084 wrote to memory of 2604	2084	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.20451.3420.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.20451.3420.dll,#1
  2⤵
  PID:2604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 712
    3⤵
    - Program crash
    PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2604 -ip 2604
1⤵
PID:4828

memory/2604-133-0x00000000021C0000-0x00000000021C2000-memory.dmp

Filesize
8KB

Download