30202655ac09c4e87af419d8b461a2195fcc353f6ee7a6816b8075726e3e750b

Resubmissions

19/04/2024, 14:52

19/04/2024, 14:48

max time kernel
146s
max time network
170s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
19/04/2024, 14:52

Target

dotNET_Reactor/runtimes/brolib_x86.dll
Size

741KB
MD5

f32f8264a9be91fb4fc76e70943e67ab
SHA1

aa8d5ede0dd3647fb02c5d37c915b7599e0fff45
SHA256

993e764d172013dc43ead42a6d8e807194530957dffa06d5eec9b53e2a00934c
SHA512

1c29004739717c6c360b04bf66542828aad9f34bf0cc37e4a780c2613141c1e846d67b69dd7537479a488064147c5ba9530b4eb9b5171cdff8b5394314174e1e
SSDEEP

12288:xQsZg52nrBEgCF5kD2XFm2+3m2R9h8UXTw05nmZfRWMmAHhlyIu:xs2n1ExkD2XFm2+3m2+fAmZfRWVAx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	1756	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1756	1052	rundll32.exe	80
PID 1052 wrote to memory of 1756	1052	rundll32.exe	80
PID 1052 wrote to memory of 1756	1052	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dotNET_Reactor\runtimes\brolib_x86.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dotNET_Reactor\runtimes\brolib_x86.dll,#1
  2⤵
  PID:1756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 448
    3⤵
    - Program crash
    PID:2752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1756 -ip 1756
1⤵
PID:3084