Analysis
-
max time kernel
1473s -
max time network
1493s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
23/05/2024, 00:17
General
-
Target
rrrr/STRESS TEST/KarhuTestMem/x86/vcomp140.dll
-
Size
134KB
-
MD5
be6843ea43fe9b868585f80ad09fe293
-
SHA1
ba4d9c5bdfd97567c6d7204c34d5db59724a8bef
-
SHA256
91e8f731d23924d7434a9a938b71aa2acf51f3bb4f3d28b6eb74e9307f9a7639
-
SHA512
2905ed96384f7b34fa345427bd9a8ba81d0647c1cb3bcd5dfb8562debcc9e2138df38bd2282949b25b798623dfb9cd158d1e82f45951cf938fd9e4c93b1f32ab
-
SSDEEP
3072:oralhL5TDvgJIXfUhmsV1cHdA6HTjWTRBl/bSHoUna:3tjIIXH1H8nl/+IUna
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\KarhuTestMem\x86\vcomp140.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\KarhuTestMem\x86\vcomp140.dll",#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5008 -s 4443⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5008 -ip 50081⤵