e0f492b56cdde36c64daa34406e43e16113e7b7e43952895529dea6b65eacd6b

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 00:15

Target

quricol32.dll
Size

218KB
MD5

19306dd58bbd42f9c4fba0072a6e810a
SHA1

e6c01ab512806319db1745e73fbd55f3ac9298b3
SHA256

90864d6b81ab5b6251e3739366f2cd8ffb9bccc7c08f9c39eb4b73db17f0401b
SHA512

01f9b18438737baaa523048f518385aabdef8417ea92e38f65c3c052036b70c9329e8f07ba47af5a32edd7948a1b81cc1173b9e60db00ba1c87e2ac5c86c4340
SSDEEP

3072:Syy0/QPixg1FYvqMH5XuCtM7ZRA0ke9S7egumTBfCUuAg0Fu/5b8+zd:W0/Qqxg1FYvqMHpuCtR0VpgDTBqUuAO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4432	4112	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 4112	1508	rundll32.exe	90
PID 1508 wrote to memory of 4112	1508	rundll32.exe	90
PID 1508 wrote to memory of 4112	1508	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\quricol32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\quricol32.dll,#1
  2⤵
  PID:4112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 604
    3⤵
    - Program crash
    PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4112 -ip 4112
1⤵
PID:1664