f4d72516e3e60d2cd3a103c227be0dd923578e932bec9121b6d134d96b4d0984

Analysis

max time kernel
131s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:11

Target

Programs/Imager/ProfUIS284ad32.dll
Size

9.6MB
MD5

e56651b0cadcc180d1bfcc23232a27a3
SHA1

7a46667052ede2ce1f8699fe6f51f7a5a398229f
SHA256

5e48c5240bf20f2669caba2d8bf893c7b7a929a7d518b139f908bdb890d8832a
SHA512

7e625b8c35b71c2586d6333ee6f7e0ac641e9b5f12b463ec9721758b54a5599997ad303ebdf5a18123f222d3f39352bb03a2560464ec53a792be959fefc35120
SSDEEP

98304:lufMnqmbKzKIAiohbLm/pNY6wPWpGplR808MnmkkC:lMmbo7abLmw6wPWpGplR80qkb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	2584	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 2584	764	rundll32.exe	89
PID 764 wrote to memory of 2584	764	rundll32.exe	89
PID 764 wrote to memory of 2584	764	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\ProfUIS284ad32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\ProfUIS284ad32.dll,#1
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 668
    3⤵
    - Program crash
    PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2584 -ip 2584
1⤵
PID:4616