f70ef90b51aba69bc59afcb395023cb0f41e2a24998f2a47314a71c4a20e8355

Analysis

max time kernel
162s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 23:18

Target

CH341SER/WIN 1X/CH341PT.dll
Size

39KB
MD5

de3a0518e890d03b61415b5c1c0657ab
SHA1

c6f80f1cabb11b83fb91505d97b957ede626a558
SHA256

9e4580ab20a41ececea3e2d6bd0e3ad0616ce34f2877977e43bc2cdfee25d66b
SHA512

07265d152e0c55172e0f30e88fc6282e92ffffd9e0e50c1f788b5336cc078221fc1d411695674b85405b84cf2237431a49b18bb29cbfc61d39776c1d6f85fd74
SSDEEP

768:HRM3FrWK86sl/RCt8kcVQ59uFc4Kh1u3fTHEQzsCXhIf3rCx9zMP1:C1u67h1GTkQzsCRMWjzMP1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2060	4184	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 4184	1956	rundll32.exe	86
PID 1956 wrote to memory of 4184	1956	rundll32.exe	86
PID 1956 wrote to memory of 4184	1956	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CH341SER\WIN 1X\CH341PT.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CH341SER\WIN 1X\CH341PT.dll",#1
  2⤵
  PID:4184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 612
    3⤵
    - Program crash
    PID:2060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4184 -ip 4184
1⤵
PID:4468