961390888afda6269362287b0f909967d507bfe4d3a0926de52933cd75314a85

Analysis

max time kernel
558s
max time network
572s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2023, 13:35

Target

VAMPSET v2.2.206 - Lite/zlib1.dll
Size

76KB
MD5

72e87ad407bb28f5b471c3396296b377
SHA1

15cd01170ff8d8531fb16f4f7a1c5fbe810a1057
SHA256

91ec6085e862e1eedc254bf88efecd4fa67f486216ab3b1473915d15462e71bb
SHA512

1569939514c0e30e2fbf7d81586ada53931ac36b11f306b95b5e0741c6b32c45d88d33271223c99cd4fbd585f0675d5188557e5dfe6901f9fbb2e3e8ec98a698
SSDEEP

768:bw6vENCUvhLcSCE/StC0KuFLRO5ZikoHBc1m7s4wixE+XwVY/nToIf18IOsIOIiy:bDvENBhA+WjPLAVY/nToIfCIOsIOIip

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3816	4116	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 4116	1348	rundll32.exe	82
PID 1348 wrote to memory of 4116	1348	rundll32.exe	82
PID 1348 wrote to memory of 4116	1348	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VAMPSET v2.2.206 - Lite\zlib1.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VAMPSET v2.2.206 - Lite\zlib1.dll",#1
  2⤵
  PID:4116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 600
    3⤵
    - Program crash
    PID:3816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4116 -ip 4116
1⤵
PID:2204