b4873ade58e22893042b36bdd7c1a3316364b6ddf52952117b0975f5237cb9cd

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 13:10

Target
libdl.dll
Size 17KB
Sample240224-qephrsdc7v
SHA256 e1646c7778c24407a17881908037a49ecfcb5a980d155212d544302653a3ef62
MD5 ed925bdab51f49813686b62eb82fb4a4
SHA1 bc7c742b92a5b47089e0b400a8a80bb217e775fe
SHA512 5be99a6b0e2091fe37ff50d5a9c4fa789db27b5ba108801e4d18e99ae584ae1bc91ba3339916dff8a323155815e660f43ca54ffcc7c14c1e3f90600aedb54bd8
SSDEEP 192:9oqX4Maf/9pG1cBQS6YEn8+K8fZkkLGM2u5YiXNDTPsd9/9ZidfuOiSLU8:9XX4My/9pG1cBQS6nb6kqu28wOY8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2912	2260	WerFault.exe	29

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2260	2408	rundll32.exe	29
PID 2408 wrote to memory of 2260	2408	rundll32.exe	29
PID 2408 wrote to memory of 2260	2408	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libdl.dll,#1
  2⤵
  PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 552
    3⤵
    - Program crash
    PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2260 -ip 2260
1⤵
PID:3976

memory/2260-0-0x000000006E010000-0x000000006E02C000-memory.dmp

Download

memory/2260-1-0x000000006DFD0000-0x000000006DFF3000-memory.dmp

Download

memory/2260-2-0x000000006DDC0000-0x000000006DDE0000-memory.dmp

Download