b75ff60aaccd7c025a5a2d27afc266bf23808cf46840a4bc868859f0902e09a8

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 15:27

Target

TwistedBrush/clipboard.dll
Size

44KB
MD5

6eb8113fb62f5bf255726d1520017c29
SHA1

1480b5a537788bdb663ae4db242572a89ac1ce1d
SHA256

64c6dac03c8a8206d95d7bcd44e28e3d2459542b0a40556908a03fd421298032
SHA512

5d4f3d6a3239af25aa1deb83e01af360d9982683907fce6723db2d98a5bca146da7a4ac19004c3d56ca221b571ce49a5c3667bb31b9713966a05a60b5185bb43
SSDEEP

384:IQFzgkrKTf1y2G5qqxCLHlsnWL7ju0Mrh3TyTrFHWui+cA/8oJTQ8:I+bWTNy2GgplsnWLuhTyFHWI/8oJ7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	4944	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4944	3412	rundll32.exe	89
PID 3412 wrote to memory of 4944	3412	rundll32.exe	89
PID 3412 wrote to memory of 4944	3412	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\clipboard.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\TwistedBrush\clipboard.dll,#1
  2⤵
  PID:4944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 600
    3⤵
    - Program crash
    PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4944 -ip 4944
1⤵
PID:4792