68b729d1c7e6b424b230931dc74db2c90c08d4923130582c80a295e144dba43f

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 16:35

Target

$COMMONFILES/nProtect Shared/Engine/TeCtrl.dll
Size

490KB
MD5

8d3ae4c2855e284729e8d9be16a3639f
SHA1

60c7d9c4f3132d27bade1546001dff285a26811f
SHA256

793b526351ccacc0757f4dec8015c2dd3fc608bd14765ab191f067e17106c96a
SHA512

c818d1d2184c7980ec74ec6c3aa72e555b43d08c0d628c81145bb4272719594eae34a367a8a2943de1d9562824d45afd56262e1ad7d6cc098a12fb92e3de7358
SSDEEP

6144:4R1Ca5NhWtNE9jTpla9UftFwYxg1u+kNwJdWKYcxkzNqJPEYny:81Ca5NhWUE9fYxgwQx8Nany

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4008	4408	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 4408	3908	rundll32.exe	83
PID 3908 wrote to memory of 4408	3908	rundll32.exe	83
PID 3908 wrote to memory of 4408	3908	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\nProtect Shared\Engine\TeCtrl.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\nProtect Shared\Engine\TeCtrl.dll",#1
  2⤵
  PID:4408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 648
    3⤵
    - Program crash
    PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4408 -ip 4408
1⤵
PID:1728