89017a73a5281e755d15cb33303bbf8454654941db813fa634d733df98363899

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 08:46

Target

platformBinary32/bin/WindowsAccessBridge.dll
Size

95KB
MD5

3de11b70769b2029c69bb72e054976e2
SHA1

c7f60a0c9e22189b496cee19a038521c257a4d9a
SHA256

eceadccbe120bbe6fd265fe6b19be43148ab0eda663dd866fd8db764a4cadd22
SHA512

e0d4f3188e6c360676c781f13637f7bf7629cad690846a59210152d5c0d4b4bf4aec87a69befb771dc2f5eee92d1aefd19d3bebea7cb9020e29f1574853d2a17
SSDEEP

1536:P1LbpRSr0L5fk61kcB2iY39wqwXIA2kUnXbIXp8Whyj8Fk3W:/R9lk61kwY39zTA2bIXlwQFkm

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1180	1848	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1848	840	rundll32.exe	79
PID 840 wrote to memory of 1848	840	rundll32.exe	79
PID 840 wrote to memory of 1848	840	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\platformBinary32\bin\WindowsAccessBridge.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\platformBinary32\bin\WindowsAccessBridge.dll,#1
  2⤵
  PID:1848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 608
    3⤵
    - Program crash
    PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1848 -ip 1848
1⤵
PID:5068