209a4474cb7f906d4fd6c7df839841b7944b4917ec5f65bc0c92acfa552f9040

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 07:44

Target

$PROGRAMFILES/Bench/BService/1.1/bhelper.dll
Size

52KB
MD5

72b1a3d56f812839ae5ba3420a5ed812
SHA1

0fadb783c6c38284e5819bcaded2a1c50503f7af
SHA256

cc54e42139a9f01777833c5fbe9e545e008c74b6fa0abbc37d6d29d9976098be
SHA512

5bca01f36822e4345c792e9a65cb9823bed6ab8e7406906e089731c464056b9330dee014a968a5b4c069e72f682cf8167b131e6cc5cdb5478eb36aef6994b2b8
SSDEEP

768:/pPo7MYMiGRHPG0QXBfEte2LhTkk1qDJi22SvOUnDEDDmIGgEKA:0MYMieHofidTkepaFKA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1720	1736	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 1736	1592	rundll32.exe	28
PID 1592 wrote to memory of 1736	1592	rundll32.exe	28
PID 1592 wrote to memory of 1736	1592	rundll32.exe	28
PID 1592 wrote to memory of 1736	1592	rundll32.exe	28
PID 1592 wrote to memory of 1736	1592	rundll32.exe	28
PID 1592 wrote to memory of 1736	1592	rundll32.exe	28
PID 1592 wrote to memory of 1736	1592	rundll32.exe	28
PID 1736 wrote to memory of 1720	1736	rundll32.exe	29
PID 1736 wrote to memory of 1720	1736	rundll32.exe	29
PID 1736 wrote to memory of 1720	1736	rundll32.exe	29
PID 1736 wrote to memory of 1720	1736	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Bench\BService\1.1\bhelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Bench\BService\1.1\bhelper.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 248
    3⤵
    - Program crash
    PID:1720