27bf8e239f59a87c27cc9d1c7e92adece25427d246cb5c04fa0237930181fea9

Analysis

max time kernel
136s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 04:47

Target

$R2/WOL/PATCHW32.dll
Size

181KB
MD5

6ec517e866e476401755281837295579
SHA1

08109c2ade310c8e345c688a6b61043967bc3ff4
SHA256

0ec6e25234ad74489eb1890d4de57bb6140bb8196bdc4a5dcac90dd9d16eb2dd
SHA512

03c250b763450033b3af3e209d82ea1b56dfea527b528d27d5328fca3846f94391628106973af96f1e7ee35ad0e96fdad36a0289ab01fbc020475301725c4d29
SSDEEP

3072:+RbF7+RecMpHaXkTamtpPb/+sF8Iu3mm3MKeQEhygkFhon8mnIFlD9PqGSuH7ayh:exCetWApTRF8Iu3mm3MaEhygkFh/mn2T

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4560	1472	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 1472	380	rundll32.exe	83
PID 380 wrote to memory of 1472	380	rundll32.exe	83
PID 380 wrote to memory of 1472	380	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R2\WOL\PATCHW32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R2\WOL\PATCHW32.dll,#1
  2⤵
  PID:1472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 636
    3⤵
    - Program crash
    PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1472 -ip 1472
1⤵
PID:4732

memory/1472-0-0x0000000010000000-0x0000000010037000-memory.dmp

Filesize
220KB

Download