c44506fe6e1ede5a104008755abf5b6ace51f1a84ad656a2dccc7f2c39c0eca2

Resubmissions

19-07-2024 19:18

max time kernel
141s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
19-07-2024 19:18

Target

vclx120.dll
Size

220KB
MD5

7daa2b7fe529b45101a399b5ebf0a416
SHA1

fd73f3561d0cebe341a6c380681fb08841fa5ce6
SHA256

2bdf023c439010ce0a786ec75d943a80a8f01363712bbf69afc29d3e2b5306ed
SHA512

8e9ec71943c412fe95563e488d91e6ef0041c16a08654ff14b11953f134007657d1e6ec95952f6b9c8b8567a35368840618db06e5cd99abc43ae495a3fbc6b96
SSDEEP

3072:F4af8kXL6nX0YXjvkWQ5vYhbNkWPFOEJ8YZbjeTl0Y25zFgYBzRKy6sB65avEtAt:Oaf8kLWL7Xov8bNxdOmrfgYmHA6I

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3920	4140	WerFault.exe	73

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 2768 wrote to memory of 4140	2768	rundll32.exe	73
PID 2768 wrote to memory of 4140	2768	rundll32.exe	73
PID 2768 wrote to memory of 4140	2768	rundll32.exe	73

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vclx120.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\vclx120.dll,#1
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 696
    3⤵
    - Program crash
    PID:3920

memory/4140-0-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/4140-1-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/4140-2-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download