40702b0d2a57d292c5bdfbf1ab1db3da71dacc942dc6838b10458f185800d6e5

Analysis

max time kernel
148s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 14:43

Target

MultiBit/python39.dll
Size

4.3MB
MD5

a4c2ea38237477f75782625753b27939
SHA1

6547afe66147a78ff191fa36c047742aeb9adcd1
SHA256

54cbc44ec6762f35d3b6179ed01379341bf3106bcdf995fd0ef4321508ac67c7
SHA512

0350348dcb222508a0311b70357bde85d52a04aeeec131b3d66a39ea3728a7448adae61f6f25964d080345aed1d8d76d52ed705b9f8d0bfa8b3902566d3e738c
SSDEEP

49152:nyh7gD5op33dGJZleQg4KQYi4i/hoAVIuiVHP2nJMTPsXy9p4mY6CM4Ex:cZpkO4KQYi40hOuWH+JMoXQ1Y24Ex

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2240 348 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2240	348	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4836 wrote to memory of 348	4836	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 348	4836	rundll32.exe	rundll32.exe
PID 4836 wrote to memory of 348	4836	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\python39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\python39.dll,#1
2⤵
PID:348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 628
3⤵
- Program crash
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 348 -ip 348
1⤵
PID:4968