e2751b8455728c372f6552335a8b5c12a2f80003bbe806f5464d8f3982c0d002

Resubmissions

24/10/2023, 21:15

max time kernel
109s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2023, 21:15

Target

i4D5zW6J\CBSProducstInfo.dll
Size

692KB
MD5

6cd81e6343ab21a1d118243af54833a8
SHA1

bbe1a06bd85af7099fb111ac13d19df5f7f22cc0
SHA256

306970a9d265a45abbd2efaf61002980695b2de7961504cf71e2833f415e82a9
SHA512

295446e3732281b3afb6b06684e2642a79e6b284608305291cc01967c45d2ba5892ef687de084dbc9a22180233f1602a8c2236ec969ddda34c25d4f4e6691328
SSDEEP

12288:qETlpkPPcE+qXW/fLXeKGVQHL+63jcxsf+SxWWfW+XYNfCJN4C/5AWPty0Da888Y:XJWPEZ8W/fLXPGVQHL+63jEsf+SxWWfV

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4652	3232	WerFault.exe	87
2212	3232	WerFault.exe	87

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 3232	2828	rundll32.exe	87
PID 2828 wrote to memory of 3232	2828	rundll32.exe	87
PID 2828 wrote to memory of 3232	2828	rundll32.exe	87
PID 3232 wrote to memory of 4652	3232	rundll32.exe	95
PID 3232 wrote to memory of 4652	3232	rundll32.exe	95
PID 3232 wrote to memory of 4652	3232	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\i4D5zW6J\CBSProducstInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\i4D5zW6J\CBSProducstInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 680
    3⤵
    - Program crash
    PID:4652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 680
    3⤵
    - Program crash
    PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3232 -ip 3232
1⤵
PID:1176

memory/3232-0-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download