97341102993770ec886e3b8c2f4ededd9672f804aefc96d155d4782c1dfa712c

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2023 06:33

Target

HMC_x86.dll
Size

437KB
MD5

6556b0a67d77fdcc20da8098b9086db0
SHA1

55efb39000431e086e57ad2558cfc140e3602f0b
SHA256

97341102993770ec886e3b8c2f4ededd9672f804aefc96d155d4782c1dfa712c
SHA512

0675bd0f5d5f69ee8253f5679d3daea2f78e4b8c5a54a552cb348327eedf26206e8d973a744ee0a4bc4854e99ceb6d7b79a339b90911dbf1e4d1f742b224b0ab
SSDEEP

6144:Qlx/soAYLX53r9SC9Px8K26CUkGP8xfm1HoUGAOfzMD8fpCEq:QlxPbX9kC9p8K26lY908CEq

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2372	3532	WerFault.exe	86
384	3532	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 3532	3912	rundll32.exe	86
PID 3912 wrote to memory of 3532	3912	rundll32.exe	86
PID 3912 wrote to memory of 3532	3912	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HMC_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HMC_x86.dll,#1
  2⤵
  PID:3532
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 600
    3⤵
    - Program crash
    PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 796
    3⤵
    - Program crash
    PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3532 -ip 3532
1⤵
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3532 -ip 3532
1⤵
PID:4972