7882e839fc528d5a8d81f85c12abde672e99e8fcb2fb3a1c9d5956a605aebdb7

Analysis

max time kernel
136s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 01:39

Target
360Conf.dll
Size 294KB
Sample240510-b23atabc91
SHA256 885aa4f58297382396717563137d212fbcb4299f95426c40c43abcdcecf54246
MD5 b98a1e65f209fe1f10f8564dec0f0c42
SHA1 cab41605d9b7241c134798723ecdf9d3dc2f2615
SHA512 35cd81aaa9fbadb8b174f6b2d30fa6c2c0c91786e6714073598cb09f1028790f03609de63b51c2e966021bd7da8521ec06612f0582fc1a5752ee0df7b8259b59
SSDEEP 3072:ZT+U3PPxMBToCpGnKDa+VNdTTtVhl9GZcAHQO0MzUfPR/IVxOEvWTBfd7ZnYX1m2:BZt1+l/h2cv71fBIaEvWTBFz9RR6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	4736	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4736	1124	rundll32.exe	84
PID 1124 wrote to memory of 4736	1124	rundll32.exe	84
PID 1124 wrote to memory of 4736	1124	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\360Conf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\360Conf.dll,#1
  2⤵
  PID:4736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 624
    3⤵
    - Program crash
    PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4736 -ip 4736
1⤵
PID:1552