e2751b8455728c372f6552335a8b5c12a2f80003bbe806f5464d8f3982c0d002

Resubmissions

24/10/2023, 21:15

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
24/10/2023, 21:15

Target

i4D5zW6J\DAQExp.dll
Size

1.4MB
MD5

b16ad0dd6c69c0c117c9d3647517786c
SHA1

825a54040c8e8dfe9ffb243796df806ee5b05708
SHA256

e8eace4e643ba86e5c4d1b966037a47e53836b5d328f2295713184613a72020f
SHA512

23512007a593d62c446923c446b07d64476cecf9f7ea22dbdbe48965daa482517c7f3f50a55b7b6ed3989be3df2f96004cafe3bb2204bcde401aae00ffd44632
SSDEEP

24576:ffMWltiJhYpFd0xsgDUZXW/Xt33nETMiZGwQvABbgYBO3wTgoyTG0Q0dp:TtiJhASK5Z4XWTMiAzEgYBOATgoyTG0t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2440	2176	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2176	2140	rundll32.exe	28
PID 2140 wrote to memory of 2176	2140	rundll32.exe	28
PID 2140 wrote to memory of 2176	2140	rundll32.exe	28
PID 2140 wrote to memory of 2176	2140	rundll32.exe	28
PID 2140 wrote to memory of 2176	2140	rundll32.exe	28
PID 2140 wrote to memory of 2176	2140	rundll32.exe	28
PID 2140 wrote to memory of 2176	2140	rundll32.exe	28
PID 2176 wrote to memory of 2440	2176	rundll32.exe	29
PID 2176 wrote to memory of 2440	2176	rundll32.exe	29
PID 2176 wrote to memory of 2440	2176	rundll32.exe	29
PID 2176 wrote to memory of 2440	2176	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\i4D5zW6J\DAQExp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\i4D5zW6J\DAQExp.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 236
    3⤵
    - Program crash
    PID:2440