eabb567d402c51623e0563016748fdb1b8d701b6bcb0509eb65f8aa05d694162

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 12:23

Target

Lenin_Script/dll/dlls.dll
Size

52KB
MD5

2a62b6205d28c98da5ed0fe2a9e09abe
SHA1

51ec112c5e43d6ad083330a638deda6917c55aa1
SHA256

394e8de908cecc40638ff20c3ac14b7f81dcaf636d5b687f24329b71b3e8935f
SHA512

dcbf4f347fc8f03c7311a0833e14f5b6aecd7f0c2c31a55fb8bc6c339be348fc91c2b801eb7dc4be36faa0f62d007da06950fc5e4e7bcbbf1b0a5bc9e1fd98bb
SSDEEP

768:CVXqYKk3DTHtNSIwd3W/Prr5jEjxSwRgbN4jzCpmGHtKQMCCH4iFwG+tV:yXqYKiHtAGXfZwRONsMmGHyH4uwv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2356	4392	WerFault.exe	28

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4392	4800	rundll32.exe	28
PID 4800 wrote to memory of 4392	4800	rundll32.exe	28
PID 4800 wrote to memory of 4392	4800	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\dlls.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Lenin_Script\dll\dlls.dll,#1
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 556
    3⤵
    - Program crash
    PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4392 -ip 4392
1⤵
PID:3428