ffc673f964fb067cdbb7998e307f8811e6cc161392dccf6273d03cadfb4e7917

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 17:44

Target
crash.dll
Size 88KB
Sample240611-wbbqdsvhnp
SHA256 61264f22f15d8fc81395f8d5b02cd14b1f9fe4729677bc5649f9515951ea0fd6
MD5 569f0737f7c397c64ac97b0c5867caee
SHA1 571cd81dc71cd7fb08843df7865bd447017ddebc
SHA512 e5d51d0b00fe12ceca5b269b1cf82074c10012cd3a811a968bbc04bb0c99fc96ec896fd1698b5156996f42a954a7d0edc60f8e3328a4eb14c8a08a7c12a9732f
SSDEEP 1536:LMoVm4jFmop00m7WR6VTTQcSEB1I5BoLbwGjrbXsb4DAv:LMoVdmoQ7WwFQjFUVrjsEDAv
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32_crash.log	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2936	2684	rundll32.exe	82
PID 2684 wrote to memory of 2936	2684	rundll32.exe	82
PID 2684 wrote to memory of 2936	2684	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\crash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\crash.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:2936

memory/2936-0-0x0000000000CA0000-0x0000000000CAF000-memory.dmp

Download