3c93d8b1e69fab840a52746dc183e2bcac113cf1f05bd558a689c0bb5f24f4aa

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 14:51

Target

CADe_SIMU V4.2/libnodave.dll
Size

124KB
MD5

3f9383240796ff0bcd7211aaffa70ec2
SHA1

29cb7113a6a08eaa701fd5d55811205d0d8499a9
SHA256

d61b4728dc1bdfbfcee780b2eecc867549ff4637bc611ba115e023d4bda493b6
SHA512

3e8eef1fa22858e40c1b97106dcf904f36aa271002e45b3b57bd1370753f413c14369e55f8e341ed09dcfd41a2cb5cbafef5021703ed2b5ae0b2f7e778ecc698
SSDEEP

1536:tyrhe5iAd5jGErfo0KtauWnuH3rXA4hBmILCC7dulTm0Dyw8jy1:tyo1NGErfOBYuHzpBXeC0lTm0gy1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1204	1656	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 2284 wrote to memory of 1656	2284	rundll32.exe	28
PID 1656 wrote to memory of 1204	1656	rundll32.exe	29
PID 1656 wrote to memory of 1204	1656	rundll32.exe	29
PID 1656 wrote to memory of 1204	1656	rundll32.exe	29
PID 1656 wrote to memory of 1204	1656	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CADe_SIMU V4.2\libnodave.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CADe_SIMU V4.2\libnodave.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 224
    3⤵
    - Program crash
    PID:1204