e46ddb2b2b2cc74e8306adc682228969d35e2943a917e321bd5db72e744d2d05

Analysis

max time kernel
488s
max time network
500s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 13:03

Target
Bloxstrap-v2.5.1-main/WebView2Loader.dll
Size 112KB
Sample240510-qata6abc72
SHA256 9d5918cec81470225be7478c7e092c24f248e8caa824d667fb57431cad94be71
MD5 5b17da9adfc5a07fa499dded4fd52747
SHA1 d1c37478f1029930a03b6bc195c8ef7093ac49b1
SHA512 f50196d520d77b920c32a12e6c6de20a2dbdf84c88e2c66e086813017a2bda909caa1aabfb4545de4f2b8cd23f2dad1e10b1571abdc62524d44bcfb355ef5432
SSDEEP 3072:HYchQScnC6uwlKuAef9p3JLT6tOT49LEt2EiJV6mYo:HlQSgC6uKppwEtriKmD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2336	2352	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 2352	4084	rundll32.exe	83
PID 4084 wrote to memory of 2352	4084	rundll32.exe	83
PID 4084 wrote to memory of 2352	4084	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.1-main\WebView2Loader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bloxstrap-v2.5.1-main\WebView2Loader.dll,#1
  2⤵
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 600
    3⤵
    - Program crash
    PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2352 -ip 2352
1⤵
PID:4344