1c0b9425bb2f4e39eb64cae968fc3c9ea83f9067dd95db6adb616e7d7f71f322

Analysis

max time kernel
136s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 00:27

Target

ConsoleMD/Retro/ConsoleMDChannel32.dll
Size

140KB
MD5

98a72e84185e781b5b0b0060fc34a58d
SHA1

4456fcbd8de7be5aefb3a5c20b455f2643e029de
SHA256

288b7387b3934857d6cf5ce8050121dad05b400e6bf9456aabf1b2fb3698013b
SHA512

e12a5918aef5b1aec9537a49b386f108a17082de7716335cd022635a83041d1785e1b1de66d9ee986eb240c3d61d6c096386764ac5cd4aa34d1ee40c5fe54882
SSDEEP

1536:p0bzJ5HjmQ8ePhicUmUEEDUw69+ligQOVkIRyvYtfqHnRFLtqdATygY8ZTzYWKWI:p0b5XMB9EQATV52DAg0FueaeTs9h4rA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4500	4828	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4828	4564	rundll32.exe	88
PID 4564 wrote to memory of 4828	4564	rundll32.exe	88
PID 4564 wrote to memory of 4828	4564	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConsoleMD\Retro\ConsoleMDChannel32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ConsoleMD\Retro\ConsoleMDChannel32.dll,#1
  2⤵
  PID:4828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 600
    3⤵
    - Program crash
    PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4828 -ip 4828
1⤵
PID:2424