8244d3c049d38b92198166cd4f16d6a77f67c731fd157683c25decf4e699867e

Analysis

max time kernel
205s
max time network
280s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16/04/2024, 19:36

Target

modules/dragon_util.dll
Size

2.5MB
MD5

f064decf723b2ab04341a8bab62c3cf9
SHA1

d7b94805ebe5ae414463afe67f462dcb4c42a3e1
SHA256

f118d842ec6b068265ab4e16ab9f9f688857ac4d227ba7059fde899bc5f9ce8a
SHA512

a975b74cb2c16fdd6c1cd76e2c1e29039442935df129b4e54bf86a570a1faa1e25a58631bf141e30a606c0659b855547ce0edfe76d6aaaf7afe2ff30799b776e
SSDEEP

49152:2X6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwl:+666666666666666666666666666666g

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1160	1656	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 1656	3588	rundll32.exe	79
PID 3588 wrote to memory of 1656	3588	rundll32.exe	79
PID 3588 wrote to memory of 1656	3588	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\modules\dragon_util.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\modules\dragon_util.dll,#1
  2⤵
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 576
    3⤵
    - Program crash
    PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1656 -ip 1656
1⤵
PID:1964