998fe1bc6d19fac4a560e00a038c487fb79c14979b2929e0d7db395030bd6945

Analysis

max time kernel
141s
max time network
267s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:48

Target

wintaylor2.1/Programs/Imager/boost_date_time-vc90-mt-1_39.dll
Size

44KB
MD5

87b3a5fe9791762b4b1f8494cb935096
SHA1

e621f1509842b417e1e5115ff57ed8f2282f951d
SHA256

817b4dd43fa228e42daac2e74c6295b0b2d52098c4e5383a5f0dd5900dd3c28d
SHA512

5f4ee2cca103542e83e0a88c23786eb87adc10d34d0ec82a9d91b491b139474615ecf4a307d675c3d1ca5696335cbd5a1e99dab8cfb7db2a01496360eaf9aaf9
SSDEEP

768:8hf/Sv47hGF9j1LWtbK29tnLHLwJRiaOyfOSgG:WiT1LW3jLH0JMaOyUG

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3596	216	WerFault.exe	85
3408	216	WerFault.exe	85

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 216	2452	rundll32.exe	85
PID 2452 wrote to memory of 216	2452	rundll32.exe	85
PID 2452 wrote to memory of 216	2452	rundll32.exe	85
PID 216 wrote to memory of 3596	216	rundll32.exe	98
PID 216 wrote to memory of 3596	216	rundll32.exe	98
PID 216 wrote to memory of 3596	216	rundll32.exe	98

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_date_time-vc90-mt-1_39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_date_time-vc90-mt-1_39.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 604
    3⤵
    - Program crash
    PID:3596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 604
    3⤵
    - Program crash
    PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 216 -ip 216
1⤵
PID:4996