ee2994270b42614eb65db99369dbe610a5ddaba06322b56c15280d1d5ec76019

Analysis

max time kernel
66s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 02:07

Target

$TEMPfolder/ortmp/smime3.dll
Size

129KB
MD5

88f553be556ae62c59b3a3fbea81987e
SHA1

166abd59cdf04380b939c3d216b514cbe09735f8
SHA256

741bf85f9011be7f57df51a409b9b43b45bed0329d14cedc05d0f84e60c66006
SHA512

d27e0ea06245782960bcffd41f9afbd9a7fe3bbb43f15eddbfa083568b21cc6dd15c86686fb597a0bf05d2bb4e76332eb7f28aba82e6a3695423f1458fb924c4
SSDEEP

3072:AUOZ75SYZdOhxAhuV9yMABbSRn8suaQZOXXoYC/6I4zdSbfoMR0NOBqN:AUOZ75P6muSMmWRntuTAdNN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2144	4416	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4416	552	rundll32.exe	85
PID 552 wrote to memory of 4416	552	rundll32.exe	85
PID 552 wrote to memory of 4416	552	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\ortmp\smime3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMPfolder\ortmp\smime3.dll,#1
  2⤵
  PID:4416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 652
    3⤵
    - Program crash
    PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4416 -ip 4416
1⤵
PID:3508