68b729d1c7e6b424b230931dc74db2c90c08d4923130582c80a295e144dba43f

Analysis

max time kernel
132s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 16:35

Target

$COMMONFILES/nProtect Shared/Engine/BwtTrust.dll
Size

242KB
MD5

8b3af122113b59638a53d6282c63edc9
SHA1

1edcf820fbbf20c8d8d8ecddbdce7dc061816204
SHA256

a15d9feb308b69d923e1c612d05101eeb035bf336e261f258e1555ad4a62679e
SHA512

838cbce1fb2fdfd12d34f4de40cc011fae010dcd9cf3469862438327b6d07313d94908834bedc67e06bd2427b4e92447800d5f8365fbd81955e3c7e1c1311299
SSDEEP

3072:I0q+kbXLiCiKw8aLlpFF77XDUuuGDHmIQ7y/Svwq:3q+cqhhXQG6PB4q

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3632	3860	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 3860	516	rundll32.exe	84
PID 516 wrote to memory of 3860	516	rundll32.exe	84
PID 516 wrote to memory of 3860	516	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\nProtect Shared\Engine\BwtTrust.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\nProtect Shared\Engine\BwtTrust.dll",#1
  2⤵
  PID:3860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 612
    3⤵
    - Program crash
    PID:3632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3860 -ip 3860
1⤵
PID:2360