4bbb6021ab01478496202bc0cfb7527b068a621093a823c8d02e696da8b6decb

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 05:47

Target

$PROGRAM_FILES_COMMON/Borland Shared/BDE/bantam.dll
Size

99KB
MD5

17f56a4ae862934a2d7e702021bdc5a1
SHA1

a7a619a786331aada902f43560a1cb0b55b6992a
SHA256

01c8fac9f5f519dfd0314ee7eb70da64afc53bf82f7831a9c16add63fde0b729
SHA512

bf1f5664d65d02737ddd965b40beeda5eb1ce05f4760d509616ddd6c0ad209c72ad3c440911473d1757107e453d84c50d752628153b2d97d3f7f35227b5ed359
SSDEEP

1536:aoBakczJxYs6SO8e0FvxreYh1S75s13ro3GZhB:aI0JxYs698e0FZxhejGh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
64	2980	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2980	2004	rundll32.exe	85
PID 2004 wrote to memory of 2980	2004	rundll32.exe	85
PID 2004 wrote to memory of 2980	2004	rundll32.exe	85

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES_COMMON\Borland Shared\BDE\bantam.dll",#1
1⤵
PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 612
  2⤵
  - Program crash
  PID:64

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$PROGRAM_FILES_COMMON\Borland Shared\BDE\bantam.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2980 -ip 2980
1⤵
PID:2468

memory/2980-0-0x000000004E8E0000-0x000000004E900000-memory.dmp

Filesize
128KB

Download