12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1

Analysis

max time kernel
363s
max time network
374s
platform
windows7_x64
resource
win7-20230712-es
resource tags

arch:x64arch:x86image:win7-20230712-eslocale:es-esos:windows7-x64systemwindows
submitted
02/08/2023, 23:39

Target

Common Files/BStorage.dll
Size

36KB
MD5

7bbce60e5874ea605f4d3f275b277f9d
SHA1

151cf2463098411b4c7ee1d5c2606b5b56dc50f0
SHA256

294861f405b78ae35a7a245b94a375a13c9e8b96efa65c8a8270e74f0f1c89bc
SHA512

2ef6e72185e0586f1b77bb828ad91244afe28f06c708555193cbbfaec5cac1ddf2cace9328a22d508d599d697ac574fe7b83bebed0eb92ef18f6c07de29ea6f8
SSDEEP

384:9/ywquJ/pyUHGYTObY0ALP4iVwkOjaWquaI+Sn:BpOUHGYcBAj4ijOOWquaHSn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	2564	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2564	2412	rundll32.exe	28
PID 2412 wrote to memory of 2564	2412	rundll32.exe	28
PID 2412 wrote to memory of 2564	2412	rundll32.exe	28
PID 2412 wrote to memory of 2564	2412	rundll32.exe	28
PID 2412 wrote to memory of 2564	2412	rundll32.exe	28
PID 2412 wrote to memory of 2564	2412	rundll32.exe	28
PID 2412 wrote to memory of 2564	2412	rundll32.exe	28
PID 2564 wrote to memory of 2416	2564	rundll32.exe	29
PID 2564 wrote to memory of 2416	2564	rundll32.exe	29
PID 2564 wrote to memory of 2416	2564	rundll32.exe	29
PID 2564 wrote to memory of 2416	2564	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\BStorage.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\BStorage.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 240
    3⤵
    - Program crash
    PID:2416

memory/2564-54-0x00000000001A0000-0x00000000001B9000-memory.dmp

Filesize
100KB

Download