ad651fcc79e346a5026b3aa5bce00dc053a45ec08be1f318eb00e93f7a02ad3f

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2023, 09:20

Target

JOYRP | ФАЙЛЫ/server_connect.dll
Size

14KB
MD5

39363881de66b773970a8c24afd6ae76
SHA1

c26f6d89049626fb2b4434466c191b257e7d9cb5
SHA256

d286c8e0fcd3eed16e6c28e89b2304fb791cce4d15f8136e41a6be062f97349f
SHA512

288e25894056aef14a1b817c5fc2640cae77f6eda383d07890611d0d04db00dd66e6e4f7c9027e68da7a1b9b2e89631806bb473e4b9764a6fdfeadd46acffeef
SSDEEP

192:HSMznoKZRtgf7cavdiCXpsXcVUO6hWJmI1jOb82e/4JabtVjhr3TJoDPEBUEYIG3:HXnoKDm7cUdFwEJmUj4GdKgBNYIG3

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3968	3964	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 3964	1320	rundll32.exe	82
PID 1320 wrote to memory of 3964	1320	rundll32.exe	82
PID 1320 wrote to memory of 3964	1320	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\JOYRP _ ФАЙЛЫ\server_connect.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\JOYRP _ ФАЙЛЫ\server_connect.dll",#1
  2⤵
  PID:3964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 564
    3⤵
    - Program crash
    PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3964 -ip 3964
1⤵
PID:2660