601d63103e7d4b41e066db1a99a0c3f353993751a87ca8460a39d33e8ee8af94

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 06:56

Target

Top Password/cudart32_91.dll
Size

292KB
MD5

05c5a28af883ebd2f1db8c83676f8e29
SHA1

36e7ed949eaed2ed9699bcb16f7ac2ae73dc9af2
SHA256

1897504f770de218e7288f9147ff192b33288219cecfbfa4a86513feda6b5089
SHA512

1bda6997aef611c9c819c21323775d5b6fc668a51084f3eb7d4f6b5a609b81169cee9709f09b5d914536295096e79640637f528bea212560c05d44bf7541c348
SSDEEP

3072:+mfqUGQYNzWORvJTFOcXq2P45m7HDi0fxpTKNMGzUxaro54R8f5uSXQ:+myUGQYNDXTFOIqpm7H9UN3garoHQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	4684	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 4684	1748	rundll32.exe	86
PID 1748 wrote to memory of 4684	1748	rundll32.exe	86
PID 1748 wrote to memory of 4684	1748	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Top Password\cudart32_91.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Top Password\cudart32_91.dll",#1
  2⤵
  PID:4684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 600
    3⤵
    - Program crash
    PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4684 -ip 4684
1⤵
PID:960