f4054cff11bed4262ce7f99fd3cb69c3358102cf3543ddc4428742b73745fde9

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 07:32

Target

HRSword-main/daemon.dll
Size

411KB
MD5

0a5953205c4d824cca92870707e568e9
SHA1

109afdffb6e4f6ebd5549ae36ffc4c91ab1429a8
SHA256

ac9eda0ff6dbe0d5868afa0a14dcb9a10379eb042f5b09749c4dcfb36c4dc0ba
SHA512

47f2c7532b5c4f5aa25c28da7bef32bff031e655ea75dfc6555b2c4585704cdcf1d3db29f543d8437906cfea722af0ee56767f27dd213d230da95997f2f1d051
SSDEEP

12288:C4jNg/cV4lMXjcRszkOAnKu3/kPCd3WnmlVnmSiRlTMve5n3sFoWQA:C4jNg/cVWMXIyoOKWnmlVnmSulTMhFoI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1948	1060	WerFault.exe	27

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1060	1932	rundll32.exe	27
PID 1932 wrote to memory of 1060	1932	rundll32.exe	27
PID 1932 wrote to memory of 1060	1932	rundll32.exe	27
PID 1932 wrote to memory of 1060	1932	rundll32.exe	27
PID 1932 wrote to memory of 1060	1932	rundll32.exe	27
PID 1932 wrote to memory of 1060	1932	rundll32.exe	27
PID 1932 wrote to memory of 1060	1932	rundll32.exe	27
PID 1060 wrote to memory of 1948	1060	rundll32.exe	28
PID 1060 wrote to memory of 1948	1060	rundll32.exe	28
PID 1060 wrote to memory of 1948	1060	rundll32.exe	28
PID 1060 wrote to memory of 1948	1060	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\daemon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\daemon.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 224
    3⤵
    - Program crash
    PID:1948

memory/1060-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download