797e52d61827ac81a4528d8ae01e56a96b26941954d644ddfa009a1a6e179fd8

Analysis

max time kernel
86s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
28/03/2024, 16:52

Target

miflash_unlock-en-6.5.224.28/AdbWinApi.dll
Size

141KB
MD5

92dc6d882009115bf5a35711739b578b
SHA1

2dbd9d0ed23b202bb739716ab1efbc003ee18f98
SHA256

7e453150b4c5fb9a6a9af409ea938bf18affb22c560cda0fac5e2a73bad30346
SHA512

1f5c36ba84d8dc0a324862c3ee41b296628c573256303ef7cc4a039affac61a560f7113f90edbb1f3d900b5bb6a0293fe8eda40bd04d0e5974a29bf641813c15
SSDEEP

3072:6WdNubaIX+4TtbGmwMai6UM8+nQUbCm+zQeqNdktT:cLTtbGJvM2enqrsT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
396	1788	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 1788	4468	rundll32.exe	80
PID 4468 wrote to memory of 1788	4468	rundll32.exe	80
PID 4468 wrote to memory of 1788	4468	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\AdbWinApi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\miflash_unlock-en-6.5.224.28\AdbWinApi.dll,#1
  2⤵
  PID:1788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 488
    3⤵
    - Program crash
    PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1788 -ip 1788
1⤵
PID:1116