f271c8f134130fbfe0655f50ebf35d421d0dde39371d8f89816e736e447f5689

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 16:51

Target
MHPT v7.dll
Size 7KB
Sample240306-vcx5cach37
SHA256 1a8e59105734c4f157b07c16b4f3cf08e1c5a83554b5e76ed7257544a4aec2a4
MD5 b4cbe3a1aaaf0647b101f3eea0704ab5
SHA1 5f772764f18a3a96e6a81ebd75c741a7ad263ff9
SHA512 c4a319d29520fd6145fa4f591792c4e4ecf97f2e7f8c986273f2545163b7c59910c4802fa24032560c01abd0d5599205bda9ca3cf72a522c14c249fe69d747e3
SSDEEP 192:I0nPXNWAxgwCMrpY7S8LqPZo5LdCfuR1nuO3:IDAxgr6+S9Pfu7n5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
748	4580	WerFault.exe	95

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 4580	1892	rundll32.exe	95
PID 1892 wrote to memory of 4580	1892	rundll32.exe	95
PID 1892 wrote to memory of 4580	1892	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MHPT v7.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MHPT v7.dll",#1
  2⤵
  PID:4580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 544
    3⤵
    - Program crash
    PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4580 -ip 4580
1⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3644 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:2100

memory/4580-0-0x0000000010000000-0x0000000010008000-memory.dmp

Download