e3ff5ca6952b263f1e3280b8ac648316a25fe1b5be45dae11317918d8856612a

Resubmissions

05-04-2024 15:10

20-12-2023 19:03

max time kernel
123s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-04-2024 15:10

Target

dino.dll
Size

5.5MB
MD5

f302435807a6a769728d89ac4fc1bd43
SHA1

c6ea54068d7deaeb3fc3c31edd3c336b804505db
SHA256

d98cd810d568f338f16c4637e8a9cb01ff69ee1967f4cfc004de3f283d61ba81
SHA512

dfd72aa484547da9b463e54fbb81bdb48597aaaff74015735d896d5348c86114210eec6d3e2069608e341dc4f37f305e9716a2cf8d1d6f00edcbc76668945e08
SSDEEP

98304:p0nxA1cmzOfO8fv1CPwDv3uFhaYtQBPoqahqLVfK7vVFw6bIRpACgv5IgpYObtJT:2dmCf/fv1CPwDv3uFhaoQBPolhqL9Kbd

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2936 1992 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2936	1992	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2816 wrote to memory of 1992	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 1992	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 1992	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 1992	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 1992	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 1992	2816	rundll32.exe	rundll32.exe
PID 2816 wrote to memory of 1992	2816	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 2936	1992	rundll32.exe	WerFault.exe
PID 1992 wrote to memory of 2936	1992	rundll32.exe	WerFault.exe
PID 1992 wrote to memory of 2936	1992	rundll32.exe	WerFault.exe
PID 1992 wrote to memory of 2936	1992	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dino.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2816

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dino.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 224
3⤵
- Program crash
PID:2936