261d00d826bdea12f7f6956ae71cd7b2fb09d6a00424506522c673e60abbeccc

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:41

Target

TargetDir/Client/CTMTBSvc.dll
Size

287KB
MD5

1b8e43c6536cf66548ce3664d4efadf3
SHA1

394b83ed56e586790123ac43a44031f07062b8d7
SHA256

a854b2c384bdf6b571da6eef2c385758165c81c624f1dd7587d9d4ddbefd3c0c
SHA512

ae35937d9d338d059272463d93c2b6bd813f94ce65826898cecac3e1653ba096e7e0618418206372e91c37b61674ddf923bdece70283c604e47cd6c5335b14b2
SSDEEP

6144:hFrjLy96lDP1j0k+d7k23BMdz5LR8idSkFVTSETWhdcbzyqoN9ju0:hFhP+d7d3qHR8i9yEFbzyTNpu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1808 2372 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1808	2372	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1712 wrote to memory of 2372	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 2372	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 2372	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 2372	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 2372	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 2372	1712	rundll32.exe	rundll32.exe
PID 1712 wrote to memory of 2372	1712	rundll32.exe	rundll32.exe
PID 2372 wrote to memory of 1808	2372	rundll32.exe	WerFault.exe
PID 2372 wrote to memory of 1808	2372	rundll32.exe	WerFault.exe
PID 2372 wrote to memory of 1808	2372	rundll32.exe	WerFault.exe
PID 2372 wrote to memory of 1808	2372	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TargetDir\Client\CTMTBSvc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TargetDir\Client\CTMTBSvc.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 236
3⤵
- Program crash
PID:1808