b89486615e9d50de29121851eb142207202c5aa9bc948ea0cfcad5016d5acc08

Resubmissions

28-06-2024 16:48

28-06-2024 16:39

max time kernel
420s
max time network
1174s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 16:39

Target

ephinea.dll
Size

27.8MB
MD5

9494ff52e400182a891f4396ecf3d935
SHA1

e536ef1f4db6f4782a57d5e0fb1759629e09b665
SHA256

6a8c4b15e26f6bf65a5356a5cab2b5aa6ac6c63a4c11214a49eb6478d2dab530
SHA512

ea78f63638628a37b2c92f01622f6f807b8eb6725976c15a44c9e7c029ca4b43ed6ad0096de7c42cbb62ab045c1f674f7a47daea22a7cddb5bd07f572f399417
SSDEEP

786432:3lJYF6uCRExfnTOXdyvpOXCsPcU6tWhKUvEs7LKJQ:rYF6tRExvTO4OW2hKOLGQ

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2748	2916	WerFault.exe	85
3340	2916	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2916	rundll32.exe
2916	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 2916	5036	rundll32.exe	85
PID 5036 wrote to memory of 2916	5036	rundll32.exe	85
PID 5036 wrote to memory of 2916	5036	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ephinea.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ephinea.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 716
    3⤵
    - Program crash
    PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 684
    3⤵
    - Program crash
    PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2916 -ip 2916
1⤵
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2916 -ip 2916
1⤵
PID:4508

memory/2916-3-0x0000000074819000-0x000000007501F000-memory.dmp

Filesize
8.0MB

Download
memory/2916-0-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/2916-1-0x0000000073140000-0x000000007565C000-memory.dmp

Filesize
37.1MB

Download
memory/2916-4-0x0000000073140000-0x000000007565C000-memory.dmp

Filesize
37.1MB

Download