024ef55d8112d913021e2f8e38294052c40d177062afebc1b462f396c86c297b

Resubmissions

29/01/2024, 04:39

29/01/2024, 02:55

29/01/2024, 01:55

29/01/2024, 01:50

29/01/2024, 01:26

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 01:26

Target
iroto.dll
Size 434KB
Sample240129-bts26sfaa4
SHA256 055b9e9af987aec9ba7adb0eef947f39b516a213d663cc52a71c7f0af146a946
MD5 e03bde4862d4d93ac2ceed85abf50b18
SHA1 7d7c288a8cf7d4e5f64d616da699712b82760303
SHA512 12e8ef09745a562567dc3d18e3be72dac09120e7756d47d23a605a82499b1ed8ff471578f0f85a35685de13c93f1ad0834a89dce5d136527f731b5e170a520f1
SSDEEP 12:e9GSG2CTi/FfILQAu//6lgR0FWdzQ2VCARHUwOLe7EEe:e9GSnCTi9ALsQiQ296LG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4804	4316	WerFault.exe	70

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4316	4696	rundll32.exe	70
PID 4696 wrote to memory of 4316	4696	rundll32.exe	70
PID 4696 wrote to memory of 4316	4696	rundll32.exe	70

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\iroto.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\iroto.dll,#1
  2⤵
  PID:4316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 544
    3⤵
    - Program crash
    PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4316 -ip 4316
1⤵
PID:1676