7011b5995a1753ef8076c92c0d07441742aabee263bbd604f690b64778b85bc7

Analysis

max time kernel
176s
max time network
253s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2023 13:18

Target

Image Logger/RTMUI.dll
Size

72KB
MD5

60fa86c9e6b796986aba82a4d5d81894
SHA1

e672f702bdbe97c3b013540c5f8c6e577e6bcfc0
SHA256

d1433ea1a5cac5abb7f3fe79a5c20ed5648a4bdd78b9ff0524b229e93254013f
SHA512

330a4c415e6bd821dcb5b757d8fc648e03f3ce6c019d6a91c18cf586379117154355562bef60230cdc08b21ea544f7f224360a6e0e9b7bd6e90c2d6d66b7560f
SSDEEP

1536:mzJUd6WiUzse2ntfh8fNIrOKtfKnLASGD2+DwmN4aBkGEjyxkeEPr7XpqD+DZQxY:mz6d6WLzse2tfh8fNsOKZKnLASGD2+DI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

556 3252 WerFault.exe rundll32.exe

pid	pid_target	process	target process
556	3252	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2588 wrote to memory of 3252	2588	rundll32.exe	rundll32.exe
PID 2588 wrote to memory of 3252	2588	rundll32.exe	rundll32.exe
PID 2588 wrote to memory of 3252	2588	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Image Logger\RTMUI.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2588

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Image Logger\RTMUI.dll",#1
2⤵
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 656
3⤵
- Program crash
PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3252 -ip 3252
1⤵
PID:3800

memory/3252-0-0x0000000002680000-0x0000000002691000-memory.dmp

Filesize
68KB

Download