7882e839fc528d5a8d81f85c12abde672e99e8fcb2fb3a1c9d5956a605aebdb7

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 01:39

Target
360compro.dll
Size 577KB
Sample240510-b23atabc91
SHA256 8d52d86b72a29e51a60bc8a586886a7737ce39a5b35d57cfa47b4619dfdb8883
MD5 0fa9009a51300dada01e5465aecf9119
SHA1 c093f075bb8f049657c48564469c937c32536117
SHA512 655f3e73b9273b897b53e627eb3d4400607d2a7d431e931fe76e225f29abf3b6fe9fac6c0384f7ffe1b3108d947b6d0c2a8ad15fb68aba71e42c9707c682cdce
SSDEEP 12288:9L8Qhz95SGOwzTcFyp1SGpP/Sz0oqwxKJsodLZ6Y1WevvpBNc:zSGOwzTc8RP/zJs2LZ6Y1Jvq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1660	1544	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 1544	3984	rundll32.exe	84
PID 3984 wrote to memory of 1544	3984	rundll32.exe	84
PID 3984 wrote to memory of 1544	3984	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\360compro.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\360compro.dll,#1
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 652
    3⤵
    - Program crash
    PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1544 -ip 1544
1⤵
PID:988