c3292a1a8b5708160e8d863844eb20ee0aad7ea0d827cb7bec429c70416f35cf

Analysis

max time kernel
128s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:44

Target
lib/bin/dcpr.dll
Size 140KB
Sample240603-pypr7sgc32
SHA256 d6e172f859953f27dabd0ec0b930f76ab3e2b05caf929859c39281441591dd40
MD5 131b4a15d0a41c8346b837c8be017566
SHA1 bb16db9ad675585b8fe816e54e6fd9652e0afb62
SHA512 0b91bd259e300a73bc7accce6276ddc240b8e63fa62be9d40cdd1146b2e009c41926566dabc11044550e6e95276836bb60febb03947cec1449118531bd18e846
SSDEEP 3072:H5f+Nlo9WEoITWojGylYCE2Iu2jGLF5A9bE8LUeRBcj3:oS/omTGgYCE2L1F5A9bEGUeRC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	2616	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 2616	3092	rundll32.exe	83
PID 3092 wrote to memory of 2616	3092	rundll32.exe	83
PID 3092 wrote to memory of 2616	3092	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\dcpr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lib\bin\dcpr.dll,#1
  2⤵
  PID:2616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 604
    3⤵
    - Program crash
    PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2616 -ip 2616
1⤵
PID:4264