12978eef9daed92259dc10c461bdf027cc646b49425f9941da73d4ded1483d86

Analysis

max time kernel
49s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 20:18

Target

AVCBurnFree.dll
Size

1.4MB
MD5

ad3042a2395975581ffcede9649f4f3d
SHA1

dbc01ec557d2b3604225d0a35e97c20c0827756d
SHA256

beda7e8422595d4344ffd9bcd305d225331aae0da62094b11c81018cf526c954
SHA512

01aa7ee61623d8672bb19099acdfa08b3a2bbc699f3988fdfc2d1294c71a5634abf5344dd583f2fce84d8f9af690bf9fd222cba84f31507945e084e450c770fa
SSDEEP

24576:Te/0dCtfAJQmJ6rqN+jtKiCgyh5RyFa2dfj6any95+9ppU4w7wYqZncdNrX6bnin:Sfyh5/4w7MZcLy0e82TQZir2vh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4888	3116	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 3116	376	rundll32.exe	82
PID 376 wrote to memory of 3116	376	rundll32.exe	82
PID 376 wrote to memory of 3116	376	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AVCBurnFree.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AVCBurnFree.dll,#1
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 660
    3⤵
    - Program crash
    PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3116 -ip 3116
1⤵
PID:4100

memory/3116-0-0x0000000000A00000-0x0000000000A9D000-memory.dmp

Filesize
628KB

Download
memory/3116-1-0x0000000002410000-0x0000000002580000-memory.dmp

Filesize
1.4MB

Download