f692935cf773826e02ded659397761a2dcac760ded63c10f7ceb2ec55b6e986a

Analysis

max time kernel
142s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 13:55

Target

1ab607240973a2b7e034cb420f09e2bf.dll
Size

19KB
MD5

1ab607240973a2b7e034cb420f09e2bf
SHA1

4729149bc31bc5cbded1f8a0be4a11e9f868aa36
SHA256

f692935cf773826e02ded659397761a2dcac760ded63c10f7ceb2ec55b6e986a
SHA512

eda585e4dad0af48bd66faa6bf20bacf8b4ddb457bf7c8647118587ef1a96ae6ce36da45023c81625ba90c89c802844d5f6a0449e3b55711093e18e94cf2d919
SSDEEP

384:CLb2vRuSfVqptUK8PC2DND7UuGSXvX/IFwgLHs9RNXXoGNVx:C20SYpJ8PC257UuG8vPgDsF4GP

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msdebug.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msdebug.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4552	4576	WerFault.exe	16

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4576	rundll32.exe
4576	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 4576	2624	rundll32.exe	16
PID 2624 wrote to memory of 4576	2624	rundll32.exe	16
PID 2624 wrote to memory of 4576	2624	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ab607240973a2b7e034cb420f09e2bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1ab607240973a2b7e034cb420f09e2bf.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 652
    3⤵
    - Program crash
    PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4576 -ip 4576
1⤵
PID:4288

memory/4576-0-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4576-1-0x00000000010F0000-0x00000000010F2000-memory.dmp

Filesize
8KB

Download
memory/4576-3-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download