81d7a32eb3d9f75a3e334d6b6052c9f8df5958ec9b6d2c16253bd9a82411b7ea

Resubmissions

10/01/2024, 11:09

10/01/2024, 11:08

10/01/2024, 11:04

10/01/2024, 09:40

10/01/2024, 09:19

10/01/2024, 09:13

max time kernel
143s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 09:13

Target
Bentley.liclib.dll
Size 285KB
Sample240110-k64twacedj
SHA256 bc563ceac43608c391362537042a52f5a4e3793aa67ef7172ce696f9eb8129cb
MD5 bbf9c8989996a68e8ae2e7c1d41edbcb
SHA1 4e6a49e9dc3fd3c41c04feba625a1264c5b598bd
SHA512 46c8a5dcff4ad12cf89e4d4b7d3406606fce06a8afe2d99674da74276b38aa418188b5c5cf4dcc868167b63eabaee3089b74d64a847edde4f8daa4872893c107
SSDEEP 6144:3uJX2Zvdh0MEl409gRiZeq8jYAOD4HnxMV:+R2ZTEl9goZr4HOV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4976	1936	WerFault.exe	90
3232	1936	WerFault.exe	90

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 1936	2648	rundll32.exe	90
PID 2648 wrote to memory of 1936	2648	rundll32.exe	90
PID 2648 wrote to memory of 1936	2648	rundll32.exe	90
PID 1936 wrote to memory of 4976	1936	rundll32.exe	98
PID 1936 wrote to memory of 4976	1936	rundll32.exe	98
PID 1936 wrote to memory of 4976	1936	rundll32.exe	98

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bentley.liclib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bentley.liclib.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 616
    3⤵
    - Program crash
    PID:4976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 616
    3⤵
    - Program crash
    PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1936 -ip 1936
1⤵
PID:1176