998fe1bc6d19fac4a560e00a038c487fb79c14979b2929e0d7db395030bd6945

Analysis

max time kernel
124s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:48

Target

wintaylor2.1/Programs/Imager/boost_thread-vc90-mt-1_39.dll
Size

45KB
MD5

74604a4cdb0e33ac87641b93da55ea15
SHA1

5bc1f47cc9c97d7f3db9607b7984e902ab1010bf
SHA256

5f070f3687847fa532853641f66a3a94859af54cdd730c9d273ac5be2a127de0
SHA512

6d3391fddb6011a9659d92a767028a8cec43e6d294eaf847e1347d04be5758d7450811f018f98603202be26d2417e946aff34f922c99dd0cb61f790400de0e43
SSDEEP

768:dTCRrFrZdFAhbbXzI7BudcZQEBVobqOyDOpzrP/9VgMEJLOw28U:8RFr76bXs7wdcZRSqOyDOpzrP/9VgMEl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2232	4564	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4564	4788	rundll32.exe	86
PID 4788 wrote to memory of 4564	4788	rundll32.exe	86
PID 4788 wrote to memory of 4564	4788	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_thread-vc90-mt-1_39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_thread-vc90-mt-1_39.dll,#1
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 624
    3⤵
    - Program crash
    PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4564 -ip 4564
1⤵
PID:4012