89017a73a5281e755d15cb33303bbf8454654941db813fa634d733df98363899

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:46

Target

platformBinary32/bin/WindowsAccessBridge-32.dll
Size

97KB
MD5

a344973ef854091e2f66168f95818140
SHA1

9402e4e5b17c11459cb19631ae25b2026ef22829
SHA256

bc18778df9b32a4dedd8c9a98908be58989a256d1b241aa0a1dec08113a7750e
SHA512

80482e45bf70d34664dc9d6ac1ebf1feb41fff08614df69cd0d200d2c489a31504f017c371542f4678f4ffa4d8a2db91cd12a3656ebe4d92ab6da37cbf268786
SSDEEP

1536:BRQLZsRXloJQrrUQ+1oIiYlM/qNX8cCkxTVPXIecTaN80nstj:B31loJQrIQ+EYlMiucbpIecudsd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4964	3472	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 3472	3856	rundll32.exe	83
PID 3856 wrote to memory of 3472	3856	rundll32.exe	83
PID 3856 wrote to memory of 3472	3856	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\platformBinary32\bin\WindowsAccessBridge-32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\platformBinary32\bin\WindowsAccessBridge-32.dll,#1
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 600
    3⤵
    - Program crash
    PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3472 -ip 3472
1⤵
PID:2080