d49874f5353ce132ee0b52eaf13b2ccd4feb74b215c776f8b28c7ceaaeb784fa

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 11:54

Target

jli.dll
Size

33.0MB
MD5

63bc5b339040c269191b17a7ea639dde
SHA1

c4dc3edddd619985e80221cc3b0980b8e422413a
SHA256

72e66a1cbe2309a0f964300bfc7a818be1b6baecda6c6581706ce1503ed8ed35
SHA512

374d0ca63918894ddb31a1d04c71e1570ca600408fe21c7ec908e3b3d5d07b6081653715543d5cc5187fe933204278340f240f6b9cfd10d20cd22cf646be9a34
SSDEEP

98304:ozoRkeRnfXwM7PF/+1yCshJhEaOtc+F/IpiMs5lpXCfqbLEr+Tz1QThMLp/3KsP7:ozQtXtbhE73W0Lp/KsPXDKg0FG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1348	2040	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 2040	3624	rundll32.exe	85
PID 3624 wrote to memory of 2040	3624	rundll32.exe	85
PID 3624 wrote to memory of 2040	3624	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jli.dll,#1
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 672
    3⤵
    - Program crash
    PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2040 -ip 2040
1⤵
PID:4500

memory/2040-0-0x0000000072DD0000-0x0000000074ED2000-memory.dmp

Filesize
33.0MB

Download