eb228a9622c7950696e0422694aad00a38db86a9b102a1cbe5481eb935c5dfe1

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 21:18

Target

$TEMP/downloader_easeus/1.0.0/17trial/aliyun/AliyunWrap.dll
Size

789KB
MD5

faa5bfe41fa009ebfdeda7eead76b89e
SHA1

4799b258e68a51992ba45349590a4c62d5cc17b7
SHA256

ed406ef69809cd4ffca6381aa84c3bcb20819bee8844fb619312bdd80d1499a0
SHA512

dbb941c8a22b16384efb9e05db087497babbf3c4d8a08baf22e3958cc59b38b2d5f44d977acb295aaba54f4bf62d1a9d8a0188a843b75f5876d0e1bde7e68137
SSDEEP

12288:LaK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0PaC4ZYI:Z9DeuBc/IPu8WMAF0PaCWYI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1848	324	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 324	2388	rundll32.exe	82
PID 2388 wrote to memory of 324	2388	rundll32.exe	82
PID 2388 wrote to memory of 324	2388	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\17trial\aliyun\AliyunWrap.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\17trial\aliyun\AliyunWrap.dll,#1
  2⤵
  PID:324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 672
    3⤵
    - Program crash
    PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 324 -ip 324
1⤵
PID:232