40702b0d2a57d292c5bdfbf1ab1db3da71dacc942dc6838b10458f185800d6e5

Analysis

max time kernel
122s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2023 20:34

Target

MultiBit/_cffi_backend.cp39-win32.dll
Size

152KB
MD5

f1e68ac35ddbfaf79df05dbb20401a3c
SHA1

90b3c5402489a6cffd99a251c96c19f8a3d860cd
SHA256

6a5660703730244900d4bda5f5c47e5017263c9c7f095c432c0a7dd56d10dddd
SHA512

db6a6fcee0168833b5d7c3e383ba5101851e0d1de6eabfc3dcd8b16edc74cfc375752e3b8e5f09fdd87d9f1abe00ddcd5947bec5743e10da2931e0dfe3fb8d77
SSDEEP

3072:GuXPZbpDR1sRn1d+MH4ghrXMlmRQpORJRAMjFU7pxyTL3q+05ivj:GUPHDA1dRYghrmpORJKMjFyxyTL6+2i7

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3032 1408 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3032	1408	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 312 wrote to memory of 1408	312	rundll32.exe	rundll32.exe
PID 312 wrote to memory of 1408	312	rundll32.exe	rundll32.exe
PID 312 wrote to memory of 1408	312	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\_cffi_backend.cp39-win32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:312

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\_cffi_backend.cp39-win32.dll,#1
2⤵
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 628
3⤵
- Program crash
PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1408 -ip 1408
1⤵
PID:3296