fd458a3b3bd8eb56e2af627e877e11b8fb9d0d4a731e262ea0ce44f0b9586de6

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 04:08

Target
Data/DRead.dll
Size 1.6MB
Sample240605-eql18sdg3z
SHA256 bca37f7b73fa66288d432ac459a19d7fbbf4704fcf58d9854293d23709492005
MD5 b174b87339152f15e575cb23ddf2d566
SHA1 347430efbd69cd88fa167fa1ea4fedf9dd74fd44
SHA512 6eac144a505b4fb31ead01500f2d2f7e7e7a57e7821ede0b5c67ed97420138391484bb25ab5b5918db60d22c776a050dba02a1d5f8800dddaa8007c1b96f1b8b
SSDEEP 24576:1YFgxWB2C2P6R0isbrE1XN/SiBXWMzb5O9rlpIiB2SnxSN2c7apT0767CFf10BRh:16eMv5xigSgN2c7apT0767CpCTt5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	2280	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 2280	4184	rundll32.exe	86
PID 4184 wrote to memory of 2280	4184	rundll32.exe	86
PID 4184 wrote to memory of 2280	4184	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\DRead.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Data\DRead.dll,#1
  2⤵
  PID:2280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 672
    3⤵
    - Program crash
    PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2280 -ip 2280
1⤵
PID:2172

memory/2280-0-0x0000000000600000-0x00000000007A9000-memory.dmp

Download