f4d72516e3e60d2cd3a103c227be0dd923578e932bec9121b6d134d96b4d0984

Analysis

max time kernel
138s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:11

Target

Programs/Imager/boost_thread-vc90-mt-1_39.dll
Size

45KB
MD5

74604a4cdb0e33ac87641b93da55ea15
SHA1

5bc1f47cc9c97d7f3db9607b7984e902ab1010bf
SHA256

5f070f3687847fa532853641f66a3a94859af54cdd730c9d273ac5be2a127de0
SHA512

6d3391fddb6011a9659d92a767028a8cec43e6d294eaf847e1347d04be5758d7450811f018f98603202be26d2417e946aff34f922c99dd0cb61f790400de0e43
SSDEEP

768:dTCRrFrZdFAhbbXzI7BudcZQEBVobqOyDOpzrP/9VgMEJLOw28U:8RFr76bXs7wdcZRSqOyDOpzrP/9VgMEl

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1684	4228	WerFault.exe	89
4440	4228	WerFault.exe	89

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 4228	684	rundll32.exe	89
PID 684 wrote to memory of 4228	684	rundll32.exe	89
PID 684 wrote to memory of 4228	684	rundll32.exe	89
PID 4228 wrote to memory of 1684	4228	rundll32.exe	93
PID 4228 wrote to memory of 1684	4228	rundll32.exe	93
PID 4228 wrote to memory of 1684	4228	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\boost_thread-vc90-mt-1_39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Programs\Imager\boost_thread-vc90-mt-1_39.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 608
    3⤵
    - Program crash
    PID:1684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 608
    3⤵
    - Program crash
    PID:4440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4228 -ip 4228
1⤵
PID:3216