14aa67b289452fbb68197a676f9a291aae35cd72c3bc7b425e7c42645aac6d65

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 02:45

Target
lz0xkoqy.dll
Size 11KB
Sample240713-c83qlascrn
SHA256 de757495d61e622adffed7588acdb5eba2f18734c13eaf9e25949779f2cb75fe
MD5 1dc8118acd04962a04f537c7dabe17be
SHA1 c04648b207433324803c595b22efaafc2423bfd3
SHA512 54107302bff8bfe9179f969f13045f83281ae9aef8ab2e723f0aa540fc46dc86d2a23b79ecfd6700b2fedbf3cf729a0693887bbad772fa993a5a7ee8bb9c0475
SSDEEP 192:IRkq0eddH2mOTFM6tlPFfYamGaGQITKzWAg8CRuDqxz6:QkS8FMOl9g0aZITQ6R5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	4944	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 4944	720	rundll32.exe	83
PID 720 wrote to memory of 4944	720	rundll32.exe	83
PID 720 wrote to memory of 4944	720	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lz0xkoqy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lz0xkoqy.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 736
    3⤵
    - Program crash
    PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4944 -ip 4944
1⤵
PID:2304

memory/4944-0-0x0000000010000000-0x0000000010006000-memory.dmp

Download

memory/4944-1-0x0000000010000000-0x0000000010006000-memory.dmp

Download