002e07e65221219d7b09fbe335dbaaa4f2277b3873a049dadae6407def532486

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 16:30

Target

PubwinSafe-v56/Server_V5.6/npptools.dll
Size

50KB
MD5

0b4ab2a97b3eef6020a8f8af553336c2
SHA1

d1e9f64dfc502112168b0d71786b21b3053e9a67
SHA256

e01c404d551273fb19fc3388ad09a495343e3fe8649399b76d082fdec5d386ab
SHA512

9d22752c031926ec7a3e81dff3149947a5a414b4f9a4a097aeb214e7ad4e0c51a94cd972a7a74ac86dc4c123af95e893c2e675c9da794230fab31e586fb0b350
SSDEEP

1536:vHLCdh/MITCc2lA+AeCsvPd1HTC/sNC21M1nQD1T2Duf:vUZMITCc2lndCsHd1W/sJ1M1nW1Tsuf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	1996	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 1996	3736	rundll32.exe	85
PID 3736 wrote to memory of 1996	3736	rundll32.exe	85
PID 3736 wrote to memory of 1996	3736	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PubwinSafe-v56\Server_V5.6\npptools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PubwinSafe-v56\Server_V5.6\npptools.dll,#1
  2⤵
  PID:1996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 632
    3⤵
    - Program crash
    PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1996 -ip 1996
1⤵
PID:3128