b9dc0bb16ff8f763ddf28513308c4b5fb89795e3afb36bc8aca2d41e408b55f4

Analysis

max time kernel
133s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 04:17

Target

UsbEAm Hosts Editor-v3.63/libcurl.dll
Size

3.9MB
MD5

63b09a70418a7dd51353f738995e6c8b
SHA1

1caf0029b8c3c24cac4722b06f5d586581288839
SHA256

fa477933a613b03652ea2a787527486d0e9225bf1d208ae77d065e35405b4ff6
SHA512

d972fe3ab1a830a6d26a2770d75c7879c1d26da0edac4344efb4de8c5464445a8b265be00ab0e4e5891a9d12b536841e4d857c723e78f8bb1f96ff2263df7e5b
SSDEEP

98304:WIjPO63r8wOOViZOeHqf3nmERCw7qQgr1gyXewHrHIxxKsZpA3Iy0RAdzop9o+w:/18wOOViZOeHqf3ndCw7qQgr1gyXewHv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2296	2368	WerFault.exe	13

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 2368	3192	rundll32.exe	13
PID 3192 wrote to memory of 2368	3192	rundll32.exe	13
PID 3192 wrote to memory of 2368	3192	rundll32.exe	13

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\UsbEAm Hosts Editor-v3.63\libcurl.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\UsbEAm Hosts Editor-v3.63\libcurl.dll",#1
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 636
    3⤵
    - Program crash
    PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2368 -ip 2368
1⤵
PID:2024

memory/2368-0-0x0000000074C70000-0x000000007505B000-memory.dmp

Filesize
3.9MB

Download