1b286678c8cdc68efc2c36261d6d898c456e24ce5fcc9e881423ba9402849037

Analysis

max time kernel
129s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 23:25

Target

ollydbg-script-master/Armadillo/ARImpRec.dll
Size

204KB
MD5

814ca983955e019c14d3048bb4d23d41
SHA1

a3d4459f8b3a2e5d1b2c092fa2d277ddb67cec33
SHA256

20af561bd1de340076f6ab0dd677bdd1d61a0ceb239c4c6361941106cf8d4620
SHA512

b88114f92979b48f26cc3fc6eb81b566fb05e580f29e4896326187d4831487f6b57fed99ea60056b0b3ef7096f2c329fbf59db45f053df651d07f2e3ba92c360
SSDEEP

3072:SZCt5jcRQP58902q2Ajrm3/6RP8pGuZeacSQnHORFywejvoGzfaxQchTBfN4Ivj+:0JR4EoTrXCWvNzCx5hTBVzj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4732	2792	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2792	3028	rundll32.exe	83
PID 3028 wrote to memory of 2792	3028	rundll32.exe	83
PID 3028 wrote to memory of 2792	3028	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ollydbg-script-master\Armadillo\ARImpRec.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ollydbg-script-master\Armadillo\ARImpRec.dll,#1
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 632
    3⤵
    - Program crash
    PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2792 -ip 2792
1⤵
PID:4900

memory/2792-0-0x0000000040000000-0x0000000040038000-memory.dmp

Filesize
224KB

Download