b75ff60aaccd7c025a5a2d27afc266bf23808cf46840a4bc868859f0902e09a8

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 15:27

Target

TwistedBrush/_ISource30.dll
Size

1.0MB
MD5

2384f086121dcd5ca9ea74cc6ba24559
SHA1

e680eef7227001286e5330eebbacab7e98760aa0
SHA256

ec89c44da35d3c592a601a804672de4d613627f706f42a9b4b06c9a60d40366a
SHA512

ecba6e37f838231ef452c126239f920be6294cf3e5293e64191b0943f44ebfa6dad001ef834fa7de785d13e0b9bcc7f8cc3cb23ee17b9b1acd3998aeab187229
SSDEEP

24576:RznYWOzS6CN6h8rRLNMhZ8iL7bmfVW1C4ySwn+nbYfb6a2NjcTrnyixSi8u:pYWOzS6x8NiDfb0VgyzT3Tryix4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	3148	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 3148	552	rundll32.exe	90
PID 552 wrote to memory of 3148	552	rundll32.exe	90
PID 552 wrote to memory of 3148	552	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\_ISource30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\_ISource30.dll,#1
  2⤵
  PID:3148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 600
    3⤵
    - Program crash
    PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3148 -ip 3148
1⤵
PID:4296