e3ff5ca6952b263f1e3280b8ac648316a25fe1b5be45dae11317918d8856612a

Resubmissions

05-04-2024 15:10

20-12-2023 19:03

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-04-2024 15:10

Target

dino.dll
Size

5.5MB
MD5

f302435807a6a769728d89ac4fc1bd43
SHA1

c6ea54068d7deaeb3fc3c31edd3c336b804505db
SHA256

d98cd810d568f338f16c4637e8a9cb01ff69ee1967f4cfc004de3f283d61ba81
SHA512

dfd72aa484547da9b463e54fbb81bdb48597aaaff74015735d896d5348c86114210eec6d3e2069608e341dc4f37f305e9716a2cf8d1d6f00edcbc76668945e08
SSDEEP

98304:p0nxA1cmzOfO8fv1CPwDv3uFhaYtQBPoqahqLVfK7vVFw6bIRpACgv5IgpYObtJT:2dmCf/fv1CPwDv3uFhaoQBPolhqL9Kbd

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4600 4500 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4600	4500	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2656 wrote to memory of 4500	2656	rundll32.exe	rundll32.exe
PID 2656 wrote to memory of 4500	2656	rundll32.exe	rundll32.exe
PID 2656 wrote to memory of 4500	2656	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dino.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dino.dll,#1
2⤵
PID:4500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 624
3⤵
- Program crash
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4500 -ip 4500
1⤵
PID:1536