6b689ea99ec6168c6a070ade3326e2458d6efd71e6fe3459c432002ac4f0a729

Analysis

max time kernel
148s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 12:42

Target

RadminViewer 3.4/raudiox.dll
Size

189KB
MD5

c9253641d67547f9337726cc41acf7b9
SHA1

a79f1ad290390f098da92137a315ea334b367976
SHA256

c7a36f1f5e8d48127f756d23a82e4957a7764a46856ebc2e86a204302ec4774e
SHA512

32da09c7a9ec3725e56469531439490c16d0611ad6cf2a6a2e6b77280b749c0f25866abd05eee7d3fc6ba9572db6878d27064e8c7c6c5e53d0cd9ef0e0cae876
SSDEEP

3072:BYhRrnSYi6dE3+65MiP7Jbgy0nRlNY8PcSMhFlOG23ZHY3iy9:Bc8MiPdoRlNDcdhr23S79

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	4548	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4548	4816	rundll32.exe	80
PID 4816 wrote to memory of 4548	4816	rundll32.exe	80
PID 4816 wrote to memory of 4548	4816	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\RadminViewer 3.4\raudiox.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\RadminViewer 3.4\raudiox.dll",#1
  2⤵
  PID:4548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 696
    3⤵
    - Program crash
    PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4548 -ip 4548
1⤵
PID:4508