59f8a5acf4045838d10094d1ef36f92935d0848078b7134c5e098ebba0d854e9

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 22:12

Target

sepscmos.dll
Size

700KB
MD5

71c89dd1e2b0acda76a06d77f1d7637e
SHA1

6341fe8d65e478d62ee9e686999819ff267d3937
SHA256

e781295bd9e942a9f075a9511b48720b95fdcaa78650cf5244beb351033f6fba
SHA512

7758b059df7662e459fa0e8e8a224b574336baa2df55f372f109e93ea6a0cc405ec01de96acde460a8cc128e161d77133bc1d5130988336d7f14ef88861bb76a
SSDEEP

12288:MbIkziqKKW0Na6sMJWFeTzYNZ4q/wETxZoXIHV/uqM0/TfEGAlEf8kBnq85uzosm:M1bKKWT6sMJWLmeyzck1OfMnVHIbh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1656	4060	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4060	3252	rundll32.exe	82
PID 3252 wrote to memory of 4060	3252	rundll32.exe	82
PID 3252 wrote to memory of 4060	3252	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sepscmos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sepscmos.dll,#1
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 624
    3⤵
    - Program crash
    PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4060 -ip 4060
1⤵
PID:3416