998fe1bc6d19fac4a560e00a038c487fb79c14979b2929e0d7db395030bd6945

Analysis

max time kernel
126s
max time network
240s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:48

Target

wintaylor2.1/Programs/Imager/boost_filesystem-vc90-mt-1_39.dll
Size

66KB
MD5

57dafae254087b961bec6f9c5a16c6cc
SHA1

bf64569095ea364e21efe9b743ed3ee9af6e6286
SHA256

9ac67e8917375b6817829ea866e06607b239a49e0d5e5000d248b1a51b507349
SHA512

8b7d9d7be7908a2e582a14241888cf0d798b7fb3abfd0fa367da5210e8cb9f83ede71c4d63c5cdec55ee76f4c1059d4448dbca7dc6592a8408f61de1813c323c
SSDEEP

768:rJvdjbmb6lpyTXL0/Q32b+ZF6/18qPqyg5Y3+gH7qlLRG7NEozIt6lGOKEcHZSYv:rp7uTXLu+ZFbwH7u0NiCGOK8Y2vH

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3556	2036	WerFault.exe	88
3000	2036	WerFault.exe	88

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 2036	4052	rundll32.exe	88
PID 4052 wrote to memory of 2036	4052	rundll32.exe	88
PID 4052 wrote to memory of 2036	4052	rundll32.exe	88
PID 2036 wrote to memory of 3556	2036	rundll32.exe	94
PID 2036 wrote to memory of 3556	2036	rundll32.exe	94
PID 2036 wrote to memory of 3556	2036	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_filesystem-vc90-mt-1_39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_filesystem-vc90-mt-1_39.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 612
    3⤵
    - Program crash
    PID:3556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 612
    3⤵
    - Program crash
    PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2036 -ip 2036
1⤵
PID:1256