6ba9d7cfc6378cdeeb2006a0cf9014c9a10bb3f1d480bebc435de97307868d7c

Resubmissions

18-06-2024 17:22

18-06-2024 17:19

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2024 17:19

Target

files/ASUS_WMI.dll
Size

224KB
MD5

32d31a667cfdd57b931d5332e2de93b6
SHA1

afd939113a0fa9a4190d3528a5191a8eb1da0a4e
SHA256

d5d3072da6a4e713fe83952e437f33920a3080d55bf54d6cbff8d97344eca0ca
SHA512

480ccc12369c1f35a413262a45c099296a6d0aa0b35afbc1447500144cfa1fb89cac2ac0f2bee36a2e317141c66a37203941612bd133c6bb1fe4037879fba25e
SSDEEP

3072:SsuqFgPmBNRP8hXzGvPkW6ZZW8egHS/jiCAg0FubAxZ+051gh9b6q4TQXdO8k:Sst2nho2ZW8edAOAZCqQXY8k

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3712 5032 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3712	5032	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1180 wrote to memory of 5032	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 5032	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 5032	1180	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ASUS_WMI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ASUS_WMI.dll,#1
2⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 572
3⤵
- Program crash
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5032 -ip 5032
1⤵
PID:2844