e2751b8455728c372f6552335a8b5c12a2f80003bbe806f5464d8f3982c0d002

Resubmissions

24/10/2023, 21:15

max time kernel
145s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24/10/2023, 21:15

Target

i4D5zW6J\CBSProducstInfo.dll
Size

692KB
MD5

6cd81e6343ab21a1d118243af54833a8
SHA1

bbe1a06bd85af7099fb111ac13d19df5f7f22cc0
SHA256

306970a9d265a45abbd2efaf61002980695b2de7961504cf71e2833f415e82a9
SHA512

295446e3732281b3afb6b06684e2642a79e6b284608305291cc01967c45d2ba5892ef687de084dbc9a22180233f1602a8c2236ec969ddda34c25d4f4e6691328
SSDEEP

12288:qETlpkPPcE+qXW/fLXeKGVQHL+63jcxsf+SxWWfW+XYNfCJN4C/5AWPty0Da888Y:XJWPEZ8W/fLXPGVQHL+63jEsf+SxWWfV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	1252	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1252	2412	rundll32.exe	28
PID 2412 wrote to memory of 1252	2412	rundll32.exe	28
PID 2412 wrote to memory of 1252	2412	rundll32.exe	28
PID 2412 wrote to memory of 1252	2412	rundll32.exe	28
PID 2412 wrote to memory of 1252	2412	rundll32.exe	28
PID 2412 wrote to memory of 1252	2412	rundll32.exe	28
PID 2412 wrote to memory of 1252	2412	rundll32.exe	28
PID 1252 wrote to memory of 2164	1252	rundll32.exe	29
PID 1252 wrote to memory of 2164	1252	rundll32.exe	29
PID 1252 wrote to memory of 2164	1252	rundll32.exe	29
PID 1252 wrote to memory of 2164	1252	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\i4D5zW6J\CBSProducstInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\i4D5zW6J\CBSProducstInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 268
    3⤵
    - Program crash
    PID:2164

memory/1252-0-0x00000000002D0000-0x0000000000388000-memory.dmp

Filesize
736KB

Download
memory/1252-1-0x00000000002D0000-0x0000000000388000-memory.dmp

Filesize
736KB

Download