0817ebba1e998e81e7c1173f5410d13b2e401396c37a490991418241baab2d38

Analysis

max time kernel
142s
max time network
273s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:08

Target

wintaylor2.1/Programs/Imager/boost_date_time-vc90-mt-1_39.dll
Size

44KB
MD5

87b3a5fe9791762b4b1f8494cb935096
SHA1

e621f1509842b417e1e5115ff57ed8f2282f951d
SHA256

817b4dd43fa228e42daac2e74c6295b0b2d52098c4e5383a5f0dd5900dd3c28d
SHA512

5f4ee2cca103542e83e0a88c23786eb87adc10d34d0ec82a9d91b491b139474615ecf4a307d675c3d1ca5696335cbd5a1e99dab8cfb7db2a01496360eaf9aaf9
SSDEEP

768:8hf/Sv47hGF9j1LWtbK29tnLHLwJRiaOyfOSgG:WiT1LW3jLH0JMaOyUG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	2508	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2508	760	rundll32.exe	87
PID 760 wrote to memory of 2508	760	rundll32.exe	87
PID 760 wrote to memory of 2508	760	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_date_time-vc90-mt-1_39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\boost_date_time-vc90-mt-1_39.dll,#1
  2⤵
  PID:2508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 604
    3⤵
    - Program crash
    PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2508 -ip 2508
1⤵
PID:3076