21c1c5b62ceebdd74177318f5aa3818680e687012d3ca057f410825db313e2ef

Analysis

max time kernel
143s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 01:51

Target

Virussign.2024.05.18/virussign.com_0631206e87f9a6629676bd2c54c2c330.dll
Size

40KB
MD5

0631206e87f9a6629676bd2c54c2c330
SHA1

c3b4f6193c3082a74b16dcfc7751b078680ef96e
SHA256

9c0a4b81970e9f40e4114c8278462314c6b03e76803252996def4b126c8f331b
SHA512

f31a76cd87468c275c09974c26683467c7f3944d7f2b4be360aea82c6f94a33ca1491edc19b42962407006654f6c00f27a130d4812228cc3cb6fb6ad92df490d
SSDEEP

384:R06/jAw+vYUGlM7lbRfq93l+0rLyNvOppJ8nksPqXLfYjY:R0DwiYUGlUX0l+0rLkvOpKqXLf

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2264 628 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2264	628	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 60 wrote to memory of 628	60	rundll32.exe	rundll32.exe
PID 60 wrote to memory of 628	60	rundll32.exe	rundll32.exe
PID 60 wrote to memory of 628	60	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Virussign.2024.05.18\virussign.com_0631206e87f9a6629676bd2c54c2c330.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:60
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Virussign.2024.05.18\virussign.com_0631206e87f9a6629676bd2c54c2c330.dll,#1
  2⤵
  PID:628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 620
    3⤵
    - Program crash
    PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 628 -ip 628
1⤵
PID:4392