cd508d5ccf885d6c14d04e7b420c2489581ee428c9a3931a325e7e003f070406

Analysis

max time kernel
138s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2023, 15:23

Target

cd508d5ccf885d6c14d04e7b420c2489581ee428c9a3931a325e7e003f070406_JC.dll
Size

478KB
MD5

d4f057a3f8652fbdb7599fb56f67cff1
SHA1

b7fc4413cf965a256051d7b8eae916b22fe0a17b
SHA256

cd508d5ccf885d6c14d04e7b420c2489581ee428c9a3931a325e7e003f070406
SHA512

d2e8b956cc5d70af5e5776c6960e31572274db4a09e7896fe3c59e7512922b47ca07a64d70dd721e18cc48e952f9eab20e2e0e79fee0df24be77f07ecc114ad8
SSDEEP

12288:AtBqnkbIQ6HHI/RpXupEP49v63zLrVVdWHAjnMn6d9:yBqnGIQ5M6DLrVVdWHAjnM6d9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3928	4736	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4736	4508	rundll32.exe	81
PID 4508 wrote to memory of 4736	4508	rundll32.exe	81
PID 4508 wrote to memory of 4736	4508	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd508d5ccf885d6c14d04e7b420c2489581ee428c9a3931a325e7e003f070406_JC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cd508d5ccf885d6c14d04e7b420c2489581ee428c9a3931a325e7e003f070406_JC.dll,#1
  2⤵
  PID:4736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 676
    3⤵
    - Program crash
    PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4736 -ip 4736
1⤵
PID:5096