d3e26c7296830666e8d5758afc850c5b596ceb3e2c1ebbb01d5dc22ff58ff5fa

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 18:47

Target
DreamMail4/Sys/IPSearcher.dll
Size 20KB
Sample240228-xfbfvsbc98
SHA256 b208167da7a5fe33ba7dfe19276b17cc580628e7c600b2038b23840b6cb89601
MD5 75d6153ab91677d01c3d1531d0dc20c6
SHA1 9312f97524fd8336693f5689816faca6af24b83e
SHA512 1a93518df4cc8ea99da063ed3dd7ebc1a8e6e65cdb290eef453d3cde7011f543ad43818ac0c00b7b6433998807a29c807cd1b5000aee51cdd92c9fee1957ae56
SSDEEP 384:EpP1lqK7WW5sFwFBKwR9qGMUJaV/xx9rcq232RbC8fQ:EbgiWW5nKwGzU4j9rcmRbtf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	2088	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2088	2876	rundll32.exe	88
PID 2876 wrote to memory of 2088	2876	rundll32.exe	88
PID 2876 wrote to memory of 2088	2876	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DreamMail4\Sys\IPSearcher.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DreamMail4\Sys\IPSearcher.dll,#1
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 616
    3⤵
    - Program crash
    PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2088 -ip 2088
1⤵
PID:4916

memory/2088-0-0x0000000010000000-0x000000001000F000-memory.dmp

Download

memory/2088-1-0x0000000010000000-0x000000001000F000-memory.dmp

Download