40702b0d2a57d292c5bdfbf1ab1db3da71dacc942dc6838b10458f185800d6e5

Analysis

max time kernel
137s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 14:43

Target

MultiBit/python3.dll
Size

59KB
MD5

ac3ec5508398b25bbc389962c114dd1e
SHA1

b006ca31eb44cacdcf2717cdf656f7cafe0983d2
SHA256

7cef1a44f3e0fc54cd4e30a4fbacfe960aa68d30b876d913b947ac18714e0b5a
SHA512

459a69a979d0734801f4c1fef978786012f020d2bb108f81e7b48ee600eebe26e06bd767230ee85eedb92a455dd2580d950ed5e011dc5d61cb3550ea01e3f7e0
SSDEEP

768:ihaX1fpzVHBlAUcfc0la6Wc6kH/ZFJ1Yu+wNBECaOMyCgUhkb0EjGTJIWQ0YYiSx:i84fwk0JIWQ0Y7SyU2S

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4140 3864 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4140	3864	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5012 wrote to memory of 3864	5012	rundll32.exe	rundll32.exe
PID 5012 wrote to memory of 3864	5012	rundll32.exe	rundll32.exe
PID 5012 wrote to memory of 3864	5012	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\python3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\python3.dll,#1
2⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 628
3⤵
- Program crash
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3864 -ip 3864
1⤵
PID:3860