bacf1ae72d809382dc9ceba302a3f1fc91542620767e9d34e5caab2a2619e133

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2024 05:41

Target

$TEMP/TeamViewer/Version5/TV.dll
Size

101KB
MD5

0023fd164efd7c7154313ed57295f86e
SHA1

a619e54451f8bb7e41fb2cb88e33fcaf2263b0d0
SHA256

604dde7ab970bd51b7703fdbc313a6d260e4797c3efbe9d9078141f5f93af954
SHA512

b4f5ac5d8dc1b76dfc1235b3d3a22e8b84d1e55b5ac5eccb788a7f8400658074c250526faefb58b42baf4dce3c7017835ae33b9d27edebf24460da9b57c32312
SSDEEP

768:gLIdQErfBiOVZUGpKxUxQgKbnlOGGJNFz5qpfOdsRn03ltW5lYNL/beFXE:zdjgOVZUATlRJ78JOdSsltSlYNHWE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4376	1420	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1420	2780	rundll32.exe	87
PID 2780 wrote to memory of 1420	2780	rundll32.exe	87
PID 2780 wrote to memory of 1420	2780	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\TeamViewer\Version5\TV.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\TeamViewer\Version5\TV.dll,#1
  2⤵
  PID:1420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 708
    3⤵
    - Program crash
    PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1420 -ip 1420
1⤵
PID:4664