0db433e95fedaa65bf599771a91a55ad495c78bc00e81201e937429fd98559aa

Analysis

max time kernel
1701s
max time network
1491s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 13:07

Target

freedom.dll
Size

740KB
MD5

f643e6ddd7afeed1c03ca69a8e71b66a
SHA1

a2c6655ead23c3c4dea9171c5aff4adfeb15ea47
SHA256

5733dc037491e1fbbd639131ee462afb69a8fe10680e72a240eed268878bdac4
SHA512

ad599fbeac0fdbd86ab6e2395c3d82a589e66bdfbef24870122580da4aaf534d610425da8cc82181b326b0fcb65972957c2e74430f6f950c1bc3cdc0da93671f
SSDEEP

12288:ab+Azqyc+GYIvPc/90guuCPzhDAQuoBmbW65dH580JAy0J7IRdwhS4O04htM1D5:ab5Wyc+GYmc0guuEtMQxmbW0dH580xY/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3372	4616	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 4616	2532	rundll32.exe	81
PID 2532 wrote to memory of 4616	2532	rundll32.exe	81
PID 2532 wrote to memory of 4616	2532	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\freedom.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\freedom.dll,#1
  2⤵
  PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 780
    3⤵
    - Program crash
    PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4616 -ip 4616
1⤵
PID:2424