f166ff7bf5585d3cff368be6a5a51673c57bb24df6c555619ee3e90c7f066a3d

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 06:49

Target
$SYSDIR/KTxtLog.dll
Size 60KB
Sample240304-hll28acd21
SHA256 2e3c095da0ce73e5ef3b83584801e8306b8605a572a6b6610bc34e9c26ce8b4a
MD5 b77bfed0ebc5db971e2a8641aa86bb58
SHA1 441285407e0e509b56492ffba64adffd2c5706aa
SHA512 1ccb5025ea12a39d87839ed2ee55fdb475d27b0bf94c96e4c291bcb0510c2ff34906c7701415f67ef61041521094be07143761369502dc70ad5c085683700cd6
SSDEEP 768:aoYlPwLqu1Zi13uXjmuGJspcdpuZ2PgeRKEJjZjOtV5/N:aoYupi13uy+SdpuZmjpktv/N
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1184	2932	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2932	1476	rundll32.exe	87
PID 1476 wrote to memory of 2932	1476	rundll32.exe	87
PID 1476 wrote to memory of 2932	1476	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\KTxtLog.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\KTxtLog.dll,#1
  2⤵
  PID:2932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 600
    3⤵
    - Program crash
    PID:1184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2932 -ip 2932
1⤵
PID:2628