89017a73a5281e755d15cb33303bbf8454654941db813fa634d733df98363899

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 08:46

Target

platformBinary32/bin/WindowsAccessBridge-32.dll
Size

97KB
MD5

a344973ef854091e2f66168f95818140
SHA1

9402e4e5b17c11459cb19631ae25b2026ef22829
SHA256

bc18778df9b32a4dedd8c9a98908be58989a256d1b241aa0a1dec08113a7750e
SHA512

80482e45bf70d34664dc9d6ac1ebf1feb41fff08614df69cd0d200d2c489a31504f017c371542f4678f4ffa4d8a2db91cd12a3656ebe4d92ab6da37cbf268786
SSDEEP

1536:BRQLZsRXloJQrrUQ+1oIiYlM/qNX8cCkxTVPXIecTaN80nstj:B31loJQrIQ+EYlMiucbpIecudsd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2144	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2144	2984	rundll32.exe	28
PID 2984 wrote to memory of 2144	2984	rundll32.exe	28
PID 2984 wrote to memory of 2144	2984	rundll32.exe	28
PID 2984 wrote to memory of 2144	2984	rundll32.exe	28
PID 2984 wrote to memory of 2144	2984	rundll32.exe	28
PID 2984 wrote to memory of 2144	2984	rundll32.exe	28
PID 2984 wrote to memory of 2144	2984	rundll32.exe	28
PID 2144 wrote to memory of 2988	2144	rundll32.exe	29
PID 2144 wrote to memory of 2988	2144	rundll32.exe	29
PID 2144 wrote to memory of 2988	2144	rundll32.exe	29
PID 2144 wrote to memory of 2988	2144	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\platformBinary32\bin\WindowsAccessBridge-32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\platformBinary32\bin\WindowsAccessBridge-32.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 220
    3⤵
    - Program crash
    PID:2988