1f18a88e9bde7482171ee1d843c956c0162cba0b5c1fd289841807c350c53d56

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 11:00

Target

b89366ee09ed61d73587eb9d1959c3b3.dll
Size

19KB
MD5

b89366ee09ed61d73587eb9d1959c3b3
SHA1

df943e4394654f2f0cfebb19aff0e84c36c6e4c3
SHA256

1f18a88e9bde7482171ee1d843c956c0162cba0b5c1fd289841807c350c53d56
SHA512

504f6678eaee6bd91103a6d121b73afeefa294e0d1c41062e42b243ef470b0ace4695962528e1b2c6170c71adc0dfa45e5f8d6b1c08e868f82d56ade0bbfbe6c
SSDEEP

384:ZLyGJUupwJF/zy/af7L4kt1vLexwjqAaGpeMG4xIhNy0gt:ZLb6upwJFLxf7Lv7OpGpDNAg

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\netsrvcs.dll	rundll32.exe
File created	C:\Windows\SysWOW64\netsrvcs.dll	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3556	4984	WerFault.exe	87

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4984	rundll32.exe
4984	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 4984	3884	rundll32.exe	87
PID 3884 wrote to memory of 4984	3884	rundll32.exe	87
PID 3884 wrote to memory of 4984	3884	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b89366ee09ed61d73587eb9d1959c3b3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b89366ee09ed61d73587eb9d1959c3b3.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 652
    3⤵
    - Program crash
    PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4984 -ip 4984
1⤵
PID:3436

memory/4984-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4984-1-0x0000000000F20000-0x0000000000F22000-memory.dmp

Filesize
8KB

Download
memory/4984-3-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download