f436a981ca6ad54d4ba251d89794162a135ed379fb50bcfe0ce73689ec4433f9

Resubmissions

05/10/2023, 13:08

05/10/2023, 12:52

05/10/2023, 12:47

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 12:47

Target

mkpub_laminos.dll
Size

2.0MB
MD5

4319468ef585bf6bdb36417cb40c680f
SHA1

c765356811023fa38001fea78ef6c70e68a63f2f
SHA256

f436a981ca6ad54d4ba251d89794162a135ed379fb50bcfe0ce73689ec4433f9
SHA512

36b482ae980574d7c801b3c31aa6b82400da4850a4a416268d2d7e121e333f8b27fe4242e2639ac59b18096a801f26711c1c856f1ece20359ce1e9d35d664474
SSDEEP

24576:u3ur2dajjr7+keK/+Ro9GIN1KtHO9/LzWCtFTrN9DOD7OD4hEoGECpAGGRMjAzkJ:u3ui02NGUINGH4qHEonk4zz5kH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4772	3604	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 3604	5100	rundll32.exe	85
PID 5100 wrote to memory of 3604	5100	rundll32.exe	85
PID 5100 wrote to memory of 3604	5100	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mkpub_laminos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\mkpub_laminos.dll,#1
  2⤵
  PID:3604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 712
    3⤵
    - Program crash
    PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3604 -ip 3604
1⤵
PID:560

memory/3604-0-0x0000000002E10000-0x000000000301D000-memory.dmp

Filesize
2.1MB

Download
memory/3604-1-0x00000000017C0000-0x00000000017C1000-memory.dmp

Filesize
4KB

Download
memory/3604-2-0x0000000003660000-0x0000000003741000-memory.dmp

Filesize
900KB

Download
memory/3604-4-0x0000000003820000-0x00000000038ED000-memory.dmp

Filesize
820KB

Download
memory/3604-3-0x0000000003820000-0x00000000038ED000-memory.dmp

Filesize
820KB

Download
memory/3604-6-0x0000000003820000-0x00000000038ED000-memory.dmp

Filesize
820KB

Download
memory/3604-8-0x0000000003820000-0x00000000038ED000-memory.dmp

Filesize
820KB

Download
memory/3604-9-0x0000000002E10000-0x000000000301D000-memory.dmp

Filesize
2.1MB

Download
memory/3604-10-0x0000000003660000-0x0000000003741000-memory.dmp

Filesize
900KB

Download