12e2820eee3b81d33d6dca1fc93635aaeb18d4acfe82e3a190301538e0a6dfc6

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 15:30

Target

SecuriteInfo.com.suspected.of.Malware.VB.46.7098.5752.dll
Size

156KB
MD5

554ce2ead277d4c14c75958b714ce392
SHA1

f39fe5a5b8ef3d88ba15d0ac8dde3c4efb68c46c
SHA256

12e2820eee3b81d33d6dca1fc93635aaeb18d4acfe82e3a190301538e0a6dfc6
SHA512

7509de3eff54d963ca28905d648e6851817a62991e5a8091a61a19704649a66ea95f5907105dac492479c6f81d09d7eeced7df56f1e1e027598c7b5bfa4c7cbc
SSDEEP

3072:CL6RFeDhnQ6jnyEs333bq50OS4hNJhMhm61XcoTkF:K63aQ8yNnbq50z4hrGc6RLk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4008	1684	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1684	1288	rundll32.exe	87
PID 1288 wrote to memory of 1684	1288	rundll32.exe	87
PID 1288 wrote to memory of 1684	1288	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.suspected.of.Malware.VB.46.7098.5752.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.suspected.of.Malware.VB.46.7098.5752.dll,#1
  2⤵
  PID:1684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 636
    3⤵
    - Program crash
    PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1684 -ip 1684
1⤵
PID:548