184238497be5068f3544229b2d294552e4891248fc17468c85c2887118cea305

Analysis

max time kernel
1794s
max time network
1223s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2023, 13:08

Target

Evon/runtimes/win-x86/native/WebView2Loader.dll
Size

104KB
MD5

9a5b63400b8f9758469627bbda1adad2
SHA1

4e14ff901760ac79879bd2a9d0f16e36999025fd
SHA256

464c49461f856c6d4ea995122e47825e7b600b88ff78c0592f56599cabd58084
SHA512

4108062abfbea5dd58e07e3dd504b23475bf098227fef50b9e849a747abd7acbff07669ef628d6937d118d3d379656c8145e0d726a52ecc2b12ec7a698e61014
SSDEEP

3072:PGlw6Jjqkv4KDRq5HdHHSWZqocPVTTEtOIp87eP3MlN:PG66hdcHdi7Et3pigclN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4472	2136	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2136	1516	rundll32.exe	84
PID 1516 wrote to memory of 2136	1516	rundll32.exe	84
PID 1516 wrote to memory of 2136	1516	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Evon\runtimes\win-x86\native\WebView2Loader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Evon\runtimes\win-x86\native\WebView2Loader.dll,#1
  2⤵
  PID:2136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 600
    3⤵
    - Program crash
    PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2136 -ip 2136
1⤵
PID:1916