eb228a9622c7950696e0422694aad00a38db86a9b102a1cbe5481eb935c5dfe1

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 21:18

Target

$TEMP/downloader_easeus/1.0.0/17trial/aliyun/AliyunWrap.dll
Size

789KB
MD5

faa5bfe41fa009ebfdeda7eead76b89e
SHA1

4799b258e68a51992ba45349590a4c62d5cc17b7
SHA256

ed406ef69809cd4ffca6381aa84c3bcb20819bee8844fb619312bdd80d1499a0
SHA512

dbb941c8a22b16384efb9e05db087497babbf3c4d8a08baf22e3958cc59b38b2d5f44d977acb295aaba54f4bf62d1a9d8a0188a843b75f5876d0e1bde7e68137
SSDEEP

12288:LaK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0PaC4ZYI:Z9DeuBc/IPu8WMAF0PaCWYI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	1840	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1840	1844	rundll32.exe	28
PID 1844 wrote to memory of 1840	1844	rundll32.exe	28
PID 1844 wrote to memory of 1840	1844	rundll32.exe	28
PID 1844 wrote to memory of 1840	1844	rundll32.exe	28
PID 1844 wrote to memory of 1840	1844	rundll32.exe	28
PID 1844 wrote to memory of 1840	1844	rundll32.exe	28
PID 1844 wrote to memory of 1840	1844	rundll32.exe	28
PID 1840 wrote to memory of 1628	1840	rundll32.exe	29
PID 1840 wrote to memory of 1628	1840	rundll32.exe	29
PID 1840 wrote to memory of 1628	1840	rundll32.exe	29
PID 1840 wrote to memory of 1628	1840	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\17trial\aliyun\AliyunWrap.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\17trial\aliyun\AliyunWrap.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 256
    3⤵
    - Program crash
    PID:1628