0c860b7f821fc9d1ac0d91410201743febcf459b95c848529a8f816a9309a240

Analysis

max time kernel
91s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 22:53

Target
ikutm.dll
Size 189KB
Sample240612-2t4f1stfmg
SHA256 e8e6486debc9bf8f494b3a5ea0bb8f21e0680c4dc5c705d44020d4725e8b2c59
MD5 39126808cbff045f09b2e19d8a9d6ded
SHA1 c4c4c2cd97c82115500eead933984f486001bebf
SHA512 45f9d2647aa3ed5ee766bc09d17baf97e593ddf1849a554c1b7bf5da3fe56161c0837c9206e6e191f10148c7ed2d0f1281633ea3d0980c60b2cee7d229bc0700
SSDEEP 3072:DFvZ09pDgyfjpmxEcQirVtcvfU1yYwOJaED8IQnZHFK:r0HUyfQrcnZks1L6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4032	3736	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 3736	2692	rundll32.exe	82
PID 2692 wrote to memory of 3736	2692	rundll32.exe	82
PID 2692 wrote to memory of 3736	2692	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ikutm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ikutm.dll,#1
  2⤵
  PID:3736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 636
    3⤵
    - Program crash
    PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3736 -ip 3736
1⤵
PID:2376