465e437108d6f904ff77ea9a39df2e764449efeb2100c79fbba6cb092b0d3633

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-05-2024 05:37

Target

$TEMP/shwa.dll
Size

23KB
MD5

e9f0406091c6e24979d02df7e6af742c
SHA1

2962e5b0043d6bcd777be53877fba3e6ade3dbe5
SHA256

a134f9624f6f880bfd2ba5b242e519961af92de5d22733892fe2373e0083ffd4
SHA512

45db0bce7c6f165fa15597d70e7da7abff0cb0e824a44f2516809157177ca7ccda0ddd0e2c74ba10be657be94700bb9d2ad81399143be94166802590ce74f5d2
SSDEEP

384:zUOLqD8OaFumDTsk2MjMdoShZrmunRyjEuG+CB+rA390dRYvo2Udpufhb7z0:zUO2DvYuKTskFQvf5UjEuvC132YvMufO

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3052 2976 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3052	2976	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2956 wrote to memory of 2976	2956	rundll32.exe	rundll32.exe
PID 2976 wrote to memory of 3052	2976	rundll32.exe	WerFault.exe
PID 2976 wrote to memory of 3052	2976	rundll32.exe	WerFault.exe
PID 2976 wrote to memory of 3052	2976	rundll32.exe	WerFault.exe
PID 2976 wrote to memory of 3052	2976	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\shwa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2956

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\shwa.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 224
3⤵
- Program crash
PID:3052