998fe1bc6d19fac4a560e00a038c487fb79c14979b2929e0d7db395030bd6945

Analysis

max time kernel
143s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:48

Target

wintaylor2.1/Programs/Imager/ProfUIS284ad32.dll
Size

9.6MB
MD5

e56651b0cadcc180d1bfcc23232a27a3
SHA1

7a46667052ede2ce1f8699fe6f51f7a5a398229f
SHA256

5e48c5240bf20f2669caba2d8bf893c7b7a929a7d518b139f908bdb890d8832a
SHA512

7e625b8c35b71c2586d6333ee6f7e0ac641e9b5f12b463ec9721758b54a5599997ad303ebdf5a18123f222d3f39352bb03a2560464ec53a792be959fefc35120
SSDEEP

98304:lufMnqmbKzKIAiohbLm/pNY6wPWpGplR808MnmkkC:lMmbo7abLmw6wPWpGplR80qkb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2428	3604	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 3604	2388	rundll32.exe	89
PID 2388 wrote to memory of 3604	2388	rundll32.exe	89
PID 2388 wrote to memory of 3604	2388	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\ProfUIS284ad32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\ProfUIS284ad32.dll,#1
  2⤵
  PID:3604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 668
    3⤵
    - Program crash
    PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3604 -ip 3604
1⤵
PID:1596