8bee452d2535953e7ad9d18fffacbef60560fc05647c735ef55393c0869b673d

Analysis

max time kernel
146s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 01:32

Target
files/ptMgr.dll
Size 2.5MB
Sample240620-byeeks1enh
SHA256 7ada08db595f00c1bafbabe168a964466fbb691caf4ac70fb63e8c4b2b2a9f85
MD5 01069f45230cd2036d138295d1019ae5
SHA1 6333e77ea19d69779d6e5445eb51c8e29c3af5c3
SHA512 0b3fa8c71b0dd117aadc64fd3dbe00639812861c3449345c45fd3037b5196259351532b3e2dadecea1318448be69794a1772d11df2fc8fbfaa8af52be3926827
SSDEEP 49152:wvSyYrklCGEFFKYy3Hlll43MkyoYh0iXGu2B1BItuEjlIeUZhQZZmRvCP:dEkGlDlH1VZ0uGu2lIr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1580	4836	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4836	4496	rundll32.exe	83
PID 4496 wrote to memory of 4836	4496	rundll32.exe	83
PID 4496 wrote to memory of 4836	4496	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ptMgr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\files\ptMgr.dll,#1
  2⤵
  PID:4836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 736
    3⤵
    - Program crash
    PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4836 -ip 4836
1⤵
PID:1584