998fe1bc6d19fac4a560e00a038c487fb79c14979b2929e0d7db395030bd6945

Analysis

max time kernel
130s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:48

Target

wintaylor2.1/Programs/Imager/ADIsoDLL.dll
Size

77KB
MD5

2a35c1cc1fe308ae8f10d80f77572418
SHA1

d10de110e8818ee6179709aede09c63380226a4e
SHA256

8678244cb99c2a8ab78afe19769561c5e0e6f63a7c61e7d4f25111e6801f07d0
SHA512

7583e8cd541c70bb4e0cc94071d3f6699fdadf925c481ef355f242569a3f70ff11c385e1b534f7a12280ba49c6f00919af41ebeb5a871c1e253d89771e7c4265
SSDEEP

1536:G+dB+6vPMePWBiHfXZtiRhN+hdups2OKJTyI0:FfXZtA3p9OKJTD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4168	3996	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 3996	1500	rundll32.exe	86
PID 1500 wrote to memory of 3996	1500	rundll32.exe	86
PID 1500 wrote to memory of 3996	1500	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\ADIsoDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\ADIsoDLL.dll,#1
  2⤵
  PID:3996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 644
    3⤵
    - Program crash
    PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3996 -ip 3996
1⤵
PID:3628

memory/3996-0-0x0000000002B10000-0x0000000002B1E000-memory.dmp

Filesize
56KB

Download
memory/3996-2-0x0000000002B30000-0x0000000002C2F000-memory.dmp

Filesize
1020KB

Download