f4054cff11bed4262ce7f99fd3cb69c3358102cf3543ddc4428742b73745fde9

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 07:32

Target

HRSword-main/DuiLib.dll
Size

1018KB
MD5

75881db475bef8ba732e15b4f140d53d
SHA1

10260d9c4dab6cece6f446c8786898f5d0217525
SHA256

c0d1608793012a5c2da2645802c144e010688da60ca5525f97068707fbf952c8
SHA512

22a14fc84f1a5b2de0c10b9a7e979d75b690bf067f9a255a20d66fe0ce8629c31c559d39f556de6e1c36ed2971b0c138d3dff30f723ee610bec2c339482668e6
SSDEEP

12288:eRCGCO+18Cj6SHQNYhsoGRf/1cWWl5Jc/C+SH7gnv7imjD/jt7a1nW7+Im6xb1X:e3Je86efdhic/C+SIjo9kp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2284	2256	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 2256	5028	rundll32.exe	80
PID 5028 wrote to memory of 2256	5028	rundll32.exe	80
PID 5028 wrote to memory of 2256	5028	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\DuiLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\DuiLib.dll,#1
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 648
    3⤵
    - Program crash
    PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2256 -ip 2256
1⤵
PID:4580