609cccd44a03bfd93cef765de354cdb2d3b847d90bc4dca0116ace0b1cfb1bc7

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 16:58

Target

HRSword x64/daemon.dll
Size

411KB
MD5

0a5953205c4d824cca92870707e568e9
SHA1

109afdffb6e4f6ebd5549ae36ffc4c91ab1429a8
SHA256

ac9eda0ff6dbe0d5868afa0a14dcb9a10379eb042f5b09749c4dcfb36c4dc0ba
SHA512

47f2c7532b5c4f5aa25c28da7bef32bff031e655ea75dfc6555b2c4585704cdcf1d3db29f543d8437906cfea722af0ee56767f27dd213d230da95997f2f1d051
SSDEEP

12288:C4jNg/cV4lMXjcRszkOAnKu3/kPCd3WnmlVnmSiRlTMve5n3sFoWQA:C4jNg/cVWMXIyoOKWnmlVnmSulTMhFoI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3572	5092	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 5092	1876	rundll32.exe	88
PID 1876 wrote to memory of 5092	1876	rundll32.exe	88
PID 1876 wrote to memory of 5092	1876	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\HRSword x64\daemon.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\HRSword x64\daemon.dll",#1
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 644
    3⤵
    - Program crash
    PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5092 -ip 5092
1⤵
PID:1932