f166ff7bf5585d3cff368be6a5a51673c57bb24df6c555619ee3e90c7f066a3d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 06:49

Target
$SYSDIR/UCLiveSocket.dll
Size 236KB
Sample240304-hll28acd21
SHA256 6bb88490b9900b3224bd16e51d04d7aabb797fb3b4a667d881bfcf2998849253
MD5 d26b2a4cc625665d559093d11f2a9a8d
SHA1 a41bc98ee40ba6e968aa5b474c14dd35003b357c
SHA512 4a3e434793234b8768a746513cf5a4fe0af054b5278f7688d82e80127027b81e21e10d13821f3084254cb80b09a5d8ef313f5c1635328ac5d9ed8029f49ea1cf
SSDEEP 3072:M1wrwjQ039wj42yOnjptvt3g4OkoiltFKDd5toZtavThzyP:mwMc62xgTHgcB5tJFy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4404	2064	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 2064	3536	rundll32.exe	87
PID 3536 wrote to memory of 2064	3536	rundll32.exe	87
PID 3536 wrote to memory of 2064	3536	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\UCLiveSocket.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\UCLiveSocket.dll,#1
  2⤵
  PID:2064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 620
    3⤵
    - Program crash
    PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2064 -ip 2064
1⤵
PID:4760