f4054cff11bed4262ce7f99fd3cb69c3358102cf3543ddc4428742b73745fde9

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 07:32

Target

HRSword-main/DuiLib.dll
Size

1018KB
MD5

75881db475bef8ba732e15b4f140d53d
SHA1

10260d9c4dab6cece6f446c8786898f5d0217525
SHA256

c0d1608793012a5c2da2645802c144e010688da60ca5525f97068707fbf952c8
SHA512

22a14fc84f1a5b2de0c10b9a7e979d75b690bf067f9a255a20d66fe0ce8629c31c559d39f556de6e1c36ed2971b0c138d3dff30f723ee610bec2c339482668e6
SSDEEP

12288:eRCGCO+18Cj6SHQNYhsoGRf/1cWWl5Jc/C+SH7gnv7imjD/jt7a1nW7+Im6xb1X:e3Je86efdhic/C+SIjo9kp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1492	872	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 108 wrote to memory of 872	108	rundll32.exe	27
PID 872 wrote to memory of 1492	872	rundll32.exe	28
PID 872 wrote to memory of 1492	872	rundll32.exe	28
PID 872 wrote to memory of 1492	872	rundll32.exe	28
PID 872 wrote to memory of 1492	872	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\DuiLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\DuiLib.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 236
    3⤵
    - Program crash
    PID:1492

memory/872-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download