ebf77438cb821feaae985e0eb14e2d22a3fecfacd04b4c16f8983de54e17c577

Analysis

max time kernel
140s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 05:39

Target

bthpanapi.dll
Size

23KB
MD5

da7b537e09234713e66e3a65e77f192e
SHA1

0f2fe7e92fcd86ef6f29bccdf496c1f6b5ec5bab
SHA256

ebf77438cb821feaae985e0eb14e2d22a3fecfacd04b4c16f8983de54e17c577
SHA512

846f5eb14da2463346a1730bec9cf6ac6bd882b2b9fa7da8831825da856d100fe2ff2e824566e148e239e0fc88d49dafb32669ec9306909ef3bb958c66abbe1b
SSDEEP

384:CDkTHXoWI1LYWiXAnwtFSLnU/Srnq+iU6JmCkmVt5S3AOcg4InyqIL4fd7VWW0gC:E5VLlyAnwtFSLnaSVdVmM7ytLk/jd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	2788	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2788	3424	rundll32.exe	90
PID 3424 wrote to memory of 2788	3424	rundll32.exe	90
PID 3424 wrote to memory of 2788	3424	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bthpanapi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bthpanapi.dll,#1
  2⤵
  PID:2788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 656
    3⤵
    - Program crash
    PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2788 -ip 2788
1⤵
PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4328,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
1⤵
PID:2444