6a0664da0332aa8f4428914ba6aff37506fd239776a881e6d24f1cf5b60cbb70

Resubmissions

24-09-2023 15:33

max time kernel
150s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2023 15:33

Target

CrashHandler.dll
Size

106KB
MD5

27e8d8c108d48b106edc7cf40f624877
SHA1

1cbdfd5d75ed2e187fdc259733527963c8752f2e
SHA256

e150138f8f126a6058ed0cb7a1306d06683eb87fc8072e10c78251e97555d592
SHA512

9ec0220138ed102c9ccaba230d30a22e6921ee89dc85414c0faec28a09e6eb052ee8bb205898a156a750f1babbe8fc736e1e7d279b34d31a2ec272aca5767a1d
SSDEEP

1536:1L8l/lkAcIPt/aUKj3J4j8sWwGyr6/NsqaA2zQdysWWcdOiiOKJrpS/9AQsPxi:J835aJJ4wsWwGy+qpzlOiiOKJFecxi

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1348 wrote to memory of 2728	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 2728	1348	rundll32.exe	rundll32.exe
PID 1348 wrote to memory of 2728	1348	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrashHandler.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrashHandler.dll,#1
2⤵
PID:2728