b62c5f76b05543c1f980ccd972666e8fb769b9fb58fc6a0142d9044fea7d40d8

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 01:35

Target
Set@up#!Files-P@ssw0rD__~2402~_/libXdmcp-6.dll
Size 28KB
Sample240224-bz3tkadh65
SHA256 7705851ba047a8154402aca92621b60be0e0e9d9b52b19bf8be540305bd53dba
MD5 7d4f4d3bc6ab6c3ea2097a7ecd018728
SHA1 2434fbad089ac85eda43c0b0e911ab437b4dfe63
SHA512 f9b64cbcd7c7c7b4e942c3da74fb280762d038f974fc23d1e0431b15787aefc87464cda121aa8fccf499af46e345dd65aa5fb5cfee1cb45dba6e5dd79b01a1d8
SSDEEP 384:sEZJxxKcB6SOd08J0DBljbG4H80iIOitbr0iIOi1Nk6qTdOoTcFbf3IU2xRov+h2:sEYWnJH80Qi0Q+ZOcFDR27e
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1264	3460	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3460	4556	rundll32.exe	85
PID 4556 wrote to memory of 3460	4556	rundll32.exe	85
PID 4556 wrote to memory of 3460	4556	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Set@up#!Files-P@ssw0rD__~2402~_\libXdmcp-6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Set@up#!Files-P@ssw0rD__~2402~_\libXdmcp-6.dll,#1
  2⤵
  PID:3460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 568
    3⤵
    - Program crash
    PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3460 -ip 3460
1⤵
PID:2040

memory/3460-0-0x000000006DBC0000-0x000000006DBCF000-memory.dmp

Download

memory/3460-2-0x000000006DDC0000-0x000000006DDE0000-memory.dmp

Download

memory/3460-1-0x000000006DFD0000-0x000000006DFF3000-memory.dmp

Download