7898acfcc553e78206fa6ef705bf1f1eabe04f3a37f774b03ea57d11163d669e

Analysis

max time kernel
55s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 20:24

Target

$TEMP/downloader_easeus/1.0.0/3free/aliyun/AliyunWrap.dll
Size

476KB
MD5

1ff4ff46834cba11482fb5d0f8c533ab
SHA1

6295fbebf55542839454c1a54c3e00355f020043
SHA256

bc2f1685f7157336027d370718dd2428c8a3883450a6191979d22745c3bca7fc
SHA512

659604861088c164d53d87bad6bbd24ef01c539d63322da541de29b9d14398c484396b16f627d2fb32b6d9b934e7a4b4a25bcfecadf9d13a7db4d9e97086c583
SSDEEP

12288:LaK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0P/:Z9DeuBc/IPu8WMAF0P/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1256	3500	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3500	5084	rundll32.exe	77
PID 5084 wrote to memory of 3500	5084	rundll32.exe	77
PID 5084 wrote to memory of 3500	5084	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3free\aliyun\AliyunWrap.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\3free\aliyun\AliyunWrap.dll,#1
  2⤵
  PID:3500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 672
    3⤵
    - Program crash
    PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3500 -ip 3500
1⤵
PID:1972