e2751b8455728c372f6552335a8b5c12a2f80003bbe806f5464d8f3982c0d002

Resubmissions

24/10/2023, 21:15

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2023, 21:15

Target

i4D5zW6J\DAQExp.dll
Size

1.4MB
MD5

b16ad0dd6c69c0c117c9d3647517786c
SHA1

825a54040c8e8dfe9ffb243796df806ee5b05708
SHA256

e8eace4e643ba86e5c4d1b966037a47e53836b5d328f2295713184613a72020f
SHA512

23512007a593d62c446923c446b07d64476cecf9f7ea22dbdbe48965daa482517c7f3f50a55b7b6ed3989be3df2f96004cafe3bb2204bcde401aae00ffd44632
SSDEEP

24576:ffMWltiJhYpFd0xsgDUZXW/Xt33nETMiZGwQvABbgYBO3wTgoyTG0Q0dp:TtiJhASK5Z4XWTMiAzEgYBOATgoyTG0t

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
752	3172	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 3172	920	rundll32.exe	86
PID 920 wrote to memory of 3172	920	rundll32.exe	86
PID 920 wrote to memory of 3172	920	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\i4D5zW6J\DAQExp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\i4D5zW6J\DAQExp.dll,#1
  2⤵
  PID:3172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 672
    3⤵
    - Program crash
    PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3172 -ip 3172
1⤵
PID:928