89017a73a5281e755d15cb33303bbf8454654941db813fa634d733df98363899

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 08:46

Target

platformBinary32/bin/WindowsAccessBridge.dll
Size

95KB
MD5

3de11b70769b2029c69bb72e054976e2
SHA1

c7f60a0c9e22189b496cee19a038521c257a4d9a
SHA256

eceadccbe120bbe6fd265fe6b19be43148ab0eda663dd866fd8db764a4cadd22
SHA512

e0d4f3188e6c360676c781f13637f7bf7629cad690846a59210152d5c0d4b4bf4aec87a69befb771dc2f5eee92d1aefd19d3bebea7cb9020e29f1574853d2a17
SSDEEP

1536:P1LbpRSr0L5fk61kcB2iY39wqwXIA2kUnXbIXp8Whyj8Fk3W:/R9lk61kwY39zTA2bIXlwQFkm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1196	2348	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2348	3000	rundll32.exe	28
PID 3000 wrote to memory of 2348	3000	rundll32.exe	28
PID 3000 wrote to memory of 2348	3000	rundll32.exe	28
PID 3000 wrote to memory of 2348	3000	rundll32.exe	28
PID 3000 wrote to memory of 2348	3000	rundll32.exe	28
PID 3000 wrote to memory of 2348	3000	rundll32.exe	28
PID 3000 wrote to memory of 2348	3000	rundll32.exe	28
PID 2348 wrote to memory of 1196	2348	rundll32.exe	29
PID 2348 wrote to memory of 1196	2348	rundll32.exe	29
PID 2348 wrote to memory of 1196	2348	rundll32.exe	29
PID 2348 wrote to memory of 1196	2348	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\platformBinary32\bin\WindowsAccessBridge.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\platformBinary32\bin\WindowsAccessBridge.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 220
    3⤵
    - Program crash
    PID:1196