0f19a4a8378e79e044d6d36b2411611dc3562f4c852d433882fa0bd8e82d1f96

Analysis

max time kernel
140s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 14:37

Target

Late 2006 lvl7/rgdx.dll
Size

1.1MB
MD5

d362a9dcecb4c45df2f3ba47a3ea0e0d
SHA1

be689bd574cca02c0bb8dd3cc3814bc1a5c724b1
SHA256

dfce3291ea1214f37aae8e009af1891c45ab7843eb639a914d9791418559a50e
SHA512

4454b7b38ed937308a683b5866fe467064169c51640b2dcb99c68bc530963df12cd1e06da279618b8c5f3214dacc394bf90fb66e07a05e2fa598c3dd8fc1cb5e
SSDEEP

12288:yYxz617NMg0oHQqDVVaHDTNR4fKHHD+IhfGHKBlXnWgD+GfGaGw5ew6IpsfZzee7:bh6MgtLgWKiIh+AWs+3aGwsYifZzeC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1276	4568	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 4568	2276	rundll32.exe	83
PID 2276 wrote to memory of 4568	2276	rundll32.exe	83
PID 2276 wrote to memory of 4568	2276	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Late 2006 lvl7\rgdx.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Late 2006 lvl7\rgdx.dll",#1
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 708
    3⤵
    - Program crash
    PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4568 -ip 4568
1⤵
PID:2620

memory/4568-0-0x0000000002960000-0x0000000002E23000-memory.dmp

Filesize
4.8MB

Download