55453f794fbc569bf4afdf593aa27ff863bf1e1c67c7ccb5eb7bf48f29ff0de4

Analysis

max time kernel
450s
max time network
1170s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:04

Target
$SYSDIR/CFCA_HSBC_CSP.dll
Size 186KB
Sample240603-n8lmvsfa72
SHA256 d9ecbdc7e2e31764549f5b7a5e8dce46cdfd6dd0664d491ec7203ba5253f610c
MD5 3381efa4d0deaf0722439c0abd15f35f
SHA1 46bbc73777b4954749055c6c7a534cf8f0422556
SHA512 eb560a40f589aec56cf2acb8229ba12c4a41dd5b835b0f79c5b583d28e6939751d544cb99bf7aa733cca269097123f05072a6eadadee0e490e4cb98de0a486d5
SSDEEP 3072:1rWstMq2tqGBM2I24tZGFruup43qWWbuPcRvYwgUBF+0:lWstN2S2p4tIFrmqWWbbRv3k0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2544	232	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 232	3772	rundll32.exe	83
PID 3772 wrote to memory of 232	3772	rundll32.exe	83
PID 3772 wrote to memory of 232	3772	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\CFCA_HSBC_CSP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\CFCA_HSBC_CSP.dll,#1
  2⤵
  PID:232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 672
    3⤵
    - Program crash
    PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 232 -ip 232
1⤵
PID:3992