629bf1d8fc528884217e3c10729995c98043fcfbdc916a6107f7a76361ca7256

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2023 06:34

Target

59e703472d7de2b38bd0146005f74e16.dll
Size

7.6MB
MD5

59e703472d7de2b38bd0146005f74e16
SHA1

d36a46fc9628d337db9d7286956c467222797be9
SHA256

629bf1d8fc528884217e3c10729995c98043fcfbdc916a6107f7a76361ca7256
SHA512

3751c2802bb589fe4a8779ded7269a84c3fdcb20409f1f0224834c97551470e3e5dfd30bb1c70687b1d6335121730cb46428825ffa67111c5d58706d641e2780
SSDEEP

196608:EcO8fB9iXvhaYE12v3b75vkAvx7NC/zK5HBbiHmUBbSd/maDOOOs:tziX5aYpkA1EWdBbiHmUBmd/mqOb

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
4	2064	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3152	2064	WerFault.exe	18

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2064	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 2064	1040	rundll32.exe	18
PID 1040 wrote to memory of 2064	1040	rundll32.exe	18
PID 1040 wrote to memory of 2064	1040	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e703472d7de2b38bd0146005f74e16.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\59e703472d7de2b38bd0146005f74e16.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: RenamesItself
  PID:2064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 760
    3⤵
    - Program crash
    PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2064 -ip 2064
1⤵
PID:2224