f4054cff11bed4262ce7f99fd3cb69c3358102cf3543ddc4428742b73745fde9

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 07:32

Target

HRSword-main/daemon.dll
Size

411KB
MD5

0a5953205c4d824cca92870707e568e9
SHA1

109afdffb6e4f6ebd5549ae36ffc4c91ab1429a8
SHA256

ac9eda0ff6dbe0d5868afa0a14dcb9a10379eb042f5b09749c4dcfb36c4dc0ba
SHA512

47f2c7532b5c4f5aa25c28da7bef32bff031e655ea75dfc6555b2c4585704cdcf1d3db29f543d8437906cfea722af0ee56767f27dd213d230da95997f2f1d051
SSDEEP

12288:C4jNg/cV4lMXjcRszkOAnKu3/kPCd3WnmlVnmSiRlTMve5n3sFoWQA:C4jNg/cVWMXIyoOKWnmlVnmSulTMhFoI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1960	1328	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1328	3144	rundll32.exe	80
PID 3144 wrote to memory of 1328	3144	rundll32.exe	80
PID 3144 wrote to memory of 1328	3144	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\daemon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HRSword-main\daemon.dll,#1
  2⤵
  PID:1328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 644
    3⤵
    - Program crash
    PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1328 -ip 1328
1⤵
PID:5092