5b3382faf060e55b994fb6fb9adc023b75ead723e0213c64fabd22a65f59e88c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 14:07

Target
g2m.dll
Size 399KB
Sample240329-rfhbhsab9v
SHA256 52cceb7014050cfcecc7c10c7ea067b20c26dbf33cec0a9cef88cbddcb048836
MD5 40a87fac95b1fee45a6660d56fe67930
SHA1 9f7a6a9f30885607d66d0d12c422d4ecf668fc6c
SHA512 13d8661cd3357057ab8ae1fd01e32cec925b4451fa1068932b5227f82a3b0b15adc12ed260d03f3e376ccea680c23165e8ca67904534ca1ecc3f5795e5d77380
SSDEEP 6144:c1PrHGV3QVKxsytQJBxeMmQspEPhsGa3JB7UgG6H:c1PyV3AevQeEPhbiS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2256	3176	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3176	2776	rundll32.exe	85
PID 2776 wrote to memory of 3176	2776	rundll32.exe	85
PID 2776 wrote to memory of 3176	2776	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\g2m.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\g2m.dll,#1
  2⤵
  PID:3176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 548
    3⤵
    - Program crash
    PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3176 -ip 3176
1⤵
PID:1740