ff3afd8eb7622bca8ea7fe7eb01daa3d0c93150d2ef0780a3d97ba674390ee97

Analysis

max time kernel
51s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 10:53

Target

luyou/dbManage.dll
Size

649KB
MD5

b980618885823447a50110738cd75081
SHA1

0ea5773c46897a50e7d722a519b0c1a33727237c
SHA256

d913d6aac862119f7d38882f9a15a0bed1a0e99eeac5f2a18d696f429ea6e246
SHA512

4bfb5314df1f83a2995ab1e7e57fe24cc3ca56fea1d3c71dd72fedebec514e6709126e6e633b7096d3177f31213bdf6ee9beb76754a324ca1902904344665e07
SSDEEP

12288:Uz4fOGQZ7ONEaC95bcr3YSHxTNdms+VyTQrQewfmCB+R6jX44cLExT/dwYIqnui5:UmO7AEas5bcT1HxLWEPf/+8jItExTq+l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3600	3012	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 3012	3896	rundll32.exe	81
PID 3896 wrote to memory of 3012	3896	rundll32.exe	81
PID 3896 wrote to memory of 3012	3896	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\dbManage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\luyou\dbManage.dll,#1
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 604
    3⤵
    - Program crash
    PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3012 -ip 3012
1⤵
PID:316