33b1cc24f787e0879be88253b5c445f9d4f9b0d8d678049dbf78fcdb94b65fe7

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:17

Target

Tool_1CD_2016v030_edit_mode/icuuc34.dll
Size

800KB
MD5

ea3f917c513010b25969f0bedafd270d
SHA1

0151072cd3af86b2746efd46c2cbcf7ab903b382
SHA256

937323c634ab23cdbfb9fa2759b11a0e23efb6980bf1e8f61e4310b0c6b89807
SHA512

9d2ae81bbbe1754c9cd5c506348a2528dc482c6d412a2faf6d63df1b9772920cb9bda865489d17e1407e816f021ff14054fb1f72332127f828134d1eabeb1a79
SSDEEP

12288:H7W2Q3LynmA/WB3V+l9bf66V9pS8GWpkOb+L5SaiaJv4IYn:YLynmAuB09brVytWpLb+dtiaJvD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4016	4192	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4564 wrote to memory of 4192	4564	rundll32.exe	88
PID 4564 wrote to memory of 4192	4564	rundll32.exe	88
PID 4564 wrote to memory of 4192	4564	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tool_1CD_2016v030_edit_mode\icuuc34.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Tool_1CD_2016v030_edit_mode\icuuc34.dll,#1
  2⤵
  PID:4192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 616
    3⤵
    - Program crash
    PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4192 -ip 4192
1⤵
PID:468