9c8e39d21afdf79241f6a99074b27730db5f3530b97a49069d4eb848766bf0a4

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 07:33

Target

EasyHiderData/Bin/boxstore.dll
Size

1.2MB
MD5

4eade486d28f267eccffcec9b2a9ca09
SHA1

3d0f9d4f49c5d840b7d877caba2bcd93ecf1a2cf
SHA256

6b37556e22d697565d6d990c18885b2db50e6370470d3e7f734d935955254156
SHA512

b39406ce0933c444f0a4efed956886ca099ecd40e9c753bd30a9a8854ebddd30f5aa6182baf7cda030ccfad4d633cd52482e9790ea19197e7817454e3ee00d13
SSDEEP

24576:UoA77myjodiCMjSvMh86DUVnh1ajpTRJjvTPJZfXGg+cVf9fykhS:UoAzjodCp4tfYbvnXGg+cVfxlhS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2012	3764	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 3764	3544	rundll32.exe	85
PID 3544 wrote to memory of 3764	3544	rundll32.exe	85
PID 3544 wrote to memory of 3764	3544	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\EasyHiderData\Bin\boxstore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\EasyHiderData\Bin\boxstore.dll,#1
  2⤵
  PID:3764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 696
    3⤵
    - Program crash
    PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3764 -ip 3764
1⤵
PID:5052