66e9f4d03e67dbcbd9d3a13bfc45b2c11e712b677e990e8ea1b405b60a3a40b2

Analysis

max time kernel
1677s
max time network
1170s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 09:34

Target

Resources/StarBurn.dll
Size

754KB
MD5

ce92db83bd93f52dfd41aed7db8c7ee3
SHA1

ee975849efc8caff9996d31466c1860d0128e3d2
SHA256

4e47378461d096d99c2fa59c93a95822341990655141f67b2e298dc0028a81e3
SHA512

4a55255bf65f143e19da42b43b801690f512789b189a57392764e5f83a965f89ed7b77072b8f4ebff2152f52baa6b7c080240665efccfbfb26bf9633f9263c0f
SSDEEP

6144:lPBb32c+U/y/giMzI+IOyLwjiwj2ybu++f+++FAOIlt0vQgKjqu5wbHmWE9qUgJZ:W/gzbnJbutf+/yOIj0v4v5Ijm7kFR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1732	5092	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 5092	3796	rundll32.exe	89
PID 3796 wrote to memory of 5092	3796	rundll32.exe	89
PID 3796 wrote to memory of 5092	3796	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resources\StarBurn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Resources\StarBurn.dll,#1
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 624
    3⤵
    - Program crash
    PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5092 -ip 5092
1⤵
PID:2400

memory/5092-0-0x00000000021B0000-0x000000000227F000-memory.dmp

Filesize
828KB

Download