b205d934150c3148b352e89367e4ef899822454d9a54cc57602b54c26bda7278

Analysis

max time kernel
133s
max time network
261s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2023, 19:46

Target

New Soft/sсriрts/binkawin.dll
Size

55KB
MD5

d51b5b46735b25c2d8372608159ed1a9
SHA1

2c178740901103d66a59131e19548d84c44fa768
SHA256

dd68562b5e4686e1a07603057db7a12040821beadd81d142bfb6a57d2de45ddb
SHA512

7c9a856fea8f7d4bddfc2b67724b475f7561979fbcf088ef2ce839e7c10870920ab4ea6b7d29254ab9d585a917eff5481c73644290350265682c627ab8fa110b
SSDEEP

1536:Ed01XORcuxj9ijJ644BXOpmE88Y+xs9PuMLHXwbJoeQ3fr:S0tOJxj9GJ644l2m78pm5uMLHX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3680	4788	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4788	4800	rundll32.exe	79
PID 4800 wrote to memory of 4788	4800	rundll32.exe	79
PID 4800 wrote to memory of 4788	4800	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\New Soft\sсriрts\binkawin.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\New Soft\sсriрts\binkawin.dll",#1
  2⤵
  PID:4788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 604
    3⤵
    - Program crash
    PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4788 -ip 4788
1⤵
PID:2288