0817ebba1e998e81e7c1173f5410d13b2e401396c37a490991418241baab2d38

Analysis

max time kernel
157s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:08

Target

wintaylor2.1/Programs/Imager/ADIsoDLL.dll
Size

77KB
MD5

2a35c1cc1fe308ae8f10d80f77572418
SHA1

d10de110e8818ee6179709aede09c63380226a4e
SHA256

8678244cb99c2a8ab78afe19769561c5e0e6f63a7c61e7d4f25111e6801f07d0
SHA512

7583e8cd541c70bb4e0cc94071d3f6699fdadf925c481ef355f242569a3f70ff11c385e1b534f7a12280ba49c6f00919af41ebeb5a871c1e253d89771e7c4265
SSDEEP

1536:G+dB+6vPMePWBiHfXZtiRhN+hdups2OKJTyI0:FfXZtA3p9OKJTD

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4304	2008	WerFault.exe	87
1968	2008	WerFault.exe	87

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 2008	3112	rundll32.exe	87
PID 3112 wrote to memory of 2008	3112	rundll32.exe	87
PID 3112 wrote to memory of 2008	3112	rundll32.exe	87
PID 2008 wrote to memory of 4304	2008	rundll32.exe	99
PID 2008 wrote to memory of 4304	2008	rundll32.exe	99
PID 2008 wrote to memory of 4304	2008	rundll32.exe	99

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\ADIsoDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wintaylor2.1\Programs\Imager\ADIsoDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 644
    3⤵
    - Program crash
    PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 644
    3⤵
    - Program crash
    PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2008 -ip 2008
1⤵
PID:4528

memory/2008-0-0x0000000001040000-0x000000000104E000-memory.dmp

Filesize
56KB

Download
memory/2008-2-0x0000000001330000-0x000000000133F000-memory.dmp

Filesize
60KB

Download