4245b59eb49f9ea2596ed1791ea2c81173acbfdfa2ceaf8e17ab418ace71d847

Analysis

max time kernel
132s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 18:10

Target

CrashSight.dll
Size

3.5MB
MD5

030673a7f2fe74ec7629dc5ed914b952
SHA1

5ac4a9962c3c6570a58eeac44f1dff32450cc33e
SHA256

8fd13c188935120339cd6c935f9e43034331dc5dc79a90b1d2d0f8bb92973705
SHA512

5ad4cd9a3c83040f2df6c33cf64d660267ebe6b9d34afa7a9ea26c9f6238e4943e65f73a4dbede609d6dfdd68b0f7121c47d7b6e72d1b5153e35016d0bcbb847
SSDEEP

49152:GAX5oOmQF+b75HDczMkeMwgO/AG+FnT0egIu0ODpvRezZadW/FCPJMHOPvTQHTs6:GAXapQFYRorbwEG+qjreIeyMHf

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2116	1980	rundll32.exe	89
PID 1980 wrote to memory of 2116	1980	rundll32.exe	89
PID 1980 wrote to memory of 2116	1980	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrashSight.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CrashSight.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116