4bbb6021ab01478496202bc0cfb7527b068a621093a823c8d02e696da8b6decb

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 05:47

Target

$PROGRAM_FILES_COMMON/Borland Shared/BDE/bantam.dll
Size

99KB
MD5

17f56a4ae862934a2d7e702021bdc5a1
SHA1

a7a619a786331aada902f43560a1cb0b55b6992a
SHA256

01c8fac9f5f519dfd0314ee7eb70da64afc53bf82f7831a9c16add63fde0b729
SHA512

bf1f5664d65d02737ddd965b40beeda5eb1ce05f4760d509616ddd6c0ad209c72ad3c440911473d1757107e453d84c50d752628153b2d97d3f7f35227b5ed359
SSDEEP

1536:aoBakczJxYs6SO8e0FvxreYh1S75s13ro3GZhB:aI0JxYs698e0FZxhejGh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	2212	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2076 wrote to memory of 2212	2076	rundll32.exe	28
PID 2212 wrote to memory of 2252	2212	rundll32.exe	29
PID 2212 wrote to memory of 2252	2212	rundll32.exe	29
PID 2212 wrote to memory of 2252	2212	rundll32.exe	29
PID 2212 wrote to memory of 2252	2212	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES_COMMON\Borland Shared\BDE\bantam.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES_COMMON\Borland Shared\BDE\bantam.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 236
    3⤵
    - Program crash
    PID:2252

memory/2212-0-0x000000004E8E0000-0x000000004E900000-memory.dmp

Filesize
128KB

Download