b62c5f76b05543c1f980ccd972666e8fb769b9fb58fc6a0142d9044fea7d40d8

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 01:35

Target
Set@up#!Files-P@ssw0rD__~2402~_/libwinpthread-1.dll
Size 96KB
Sample240224-bz3tkadh65
SHA256 b53329b607a4af6d59ce94c2ef79abad5bea6ff7045f53af721f5ca09e6f5840
MD5 e40b7acdd7654c071b0f2c17eb91fddd
SHA1 6f7f65cacb44a378169cb9066099dccf96f51426
SHA512 dcdddf8601e733947e76c6c5dca0cd7ffd2eb373ef771e43d411da3ee6d3da40f0a8f34e7599a3b7a6399fb4ee26d501d86acb08b889acc07e95a9a1d6b17a4e
SSDEEP 1536:BIW87l4cRxoT1nJesB6fyIer2UWrSvTEfqRkbORhW4iI4im3Yco+:Be79xUnJJFmATEYkbSiI4im3Yco+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3980	2316	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2316	2012	rundll32.exe	80
PID 2012 wrote to memory of 2316	2012	rundll32.exe	80
PID 2012 wrote to memory of 2316	2012	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Set@up#!Files-P@ssw0rD__~2402~_\libwinpthread-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Set@up#!Files-P@ssw0rD__~2402~_\libwinpthread-1.dll,#1
  2⤵
  PID:2316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 552
    3⤵
    - Program crash
    PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2316 -ip 2316
1⤵
PID:552