b4057bf35e38d9754f8ca6178353ea91775c6218d76eefbbd9c8c4475cff2f98

Analysis

max time kernel
90s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 13:54

Target

9996bc7eca4e9857fc7634921f2ad114.dll
Size

512KB
MD5

9996bc7eca4e9857fc7634921f2ad114
SHA1

65cb888a376988e791787ba1d26a1106b904f2d3
SHA256

b4057bf35e38d9754f8ca6178353ea91775c6218d76eefbbd9c8c4475cff2f98
SHA512

19ddc56060a6aecbefb30ff2decc96c7eaf514da0280cec05db3f2e2dcc44d80671c78b8cdda6481d74f866b0d399ed68efe77dfbc41dc5c685f94087d9164ee
SSDEEP

6144:GDmqfUahcpqGvMcrSQxZr2ITbktSJ+Yishyc4WZnHDRFTPmkmXfXQT34G:ifLcpqG0HQeKZsz+ZnHlN+bAH

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	1952	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4556 set thread context of 1952	4556	rundll32.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3892	1952	WerFault.exe	84

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 4556	4432	rundll32.exe	83
PID 4432 wrote to memory of 4556	4432	rundll32.exe	83
PID 4432 wrote to memory of 4556	4432	rundll32.exe	83
PID 4556 wrote to memory of 1952	4556	rundll32.exe	84
PID 4556 wrote to memory of 1952	4556	rundll32.exe	84
PID 4556 wrote to memory of 1952	4556	rundll32.exe	84
PID 4556 wrote to memory of 1952	4556	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9996bc7eca4e9857fc7634921f2ad114.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9996bc7eca4e9857fc7634921f2ad114.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe
    3⤵
    - Blocklisted process makes network request
    PID:1952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 1312
      4⤵
      Program crash
      PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1952 -ip 1952
1⤵
PID:4996

memory/1952-0-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download