0ee170eb92a1063c45512e55aa2c4c7e40e58e1cdc77ce13b5fe56163b871531

Analysis

max time kernel
291s
max time network
302s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
01-10-2023 09:07

Target

qnr.dll
Size

455KB
MD5

d29c850c3b5820060316176c1786c5cc
SHA1

c86dab1668b1a13ec8901db146d44f034eedf05e
SHA256

641a7339c2000604dc8f425383e9c34b1b117f647e40e1786838828a2552d27c
SHA512

cf4c8a9544fd2a2a4ddc4b00118508315f809bc2efb28c7526e951f498e349f3593e777332df960f41eca2d7600335f81c8607e5159079f8a50b8b83644e77a4
SSDEEP

12288:GowmOwSqB7wGo/DzEOdg64dBBVIDL1jRQ+sc6r:kP96w3/Dzd2VI9jGpc6r

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4448	4000	WerFault.exe	69

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 4000	1380	rundll32.exe	69
PID 1380 wrote to memory of 4000	1380	rundll32.exe	69
PID 1380 wrote to memory of 4000	1380	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\qnr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\qnr.dll,#1
  2⤵
  PID:4000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 680
    3⤵
    - Program crash
    PID:4448

memory/4000-0-0x0000000073760000-0x00000000738EA000-memory.dmp

Filesize
1.5MB

Download
memory/4000-1-0x0000000073760000-0x00000000738EA000-memory.dmp

Filesize
1.5MB

Download
memory/4000-2-0x0000000073760000-0x00000000738EA000-memory.dmp

Filesize
1.5MB

Download
memory/4000-3-0x0000000073760000-0x00000000738EA000-memory.dmp

Filesize
1.5MB

Download
memory/4000-4-0x0000000073760000-0x00000000738EA000-memory.dmp

Filesize
1.5MB

Download
memory/4000-5-0x0000000077281000-0x0000000077282000-memory.dmp

Filesize
4KB

Download
memory/4000-6-0x0000000073760000-0x00000000738EA000-memory.dmp

Filesize
1.5MB

Download