15855eb71ab14975030f8556e6f375d0dc1119d3c577f960d9cf74b8994a0ea1

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 18:28

Target

KwLib.dll
Size

534KB
MD5

3b3037a224ce0e4a6b76f167daba77c1
SHA1

8abe17602fd45aaa5f7cb570e931820fee352f73
SHA256

b0d74aa308b8ebf777028bf3099440005f7dea495b3fde2d36a6173f8af6af4e
SHA512

58bc7134c95031c74d3bd772b4f85839ecc71c49a55d69461db5d39105c137c944fedda840a3326b8658130c1e70affef20073120832087fed74bdf58b9fe4b5
SSDEEP

12288:HUc/Q1cnuCWGGZTy3XZglJZc5TaFZ803R:x/Q1cnuUiy3XmlbmTCe03

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mylkx.dat	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1680	2372	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2936 wrote to memory of 2372	2936	rundll32.exe	28
PID 2372 wrote to memory of 1680	2372	rundll32.exe	29
PID 2372 wrote to memory of 1680	2372	rundll32.exe	29
PID 2372 wrote to memory of 1680	2372	rundll32.exe	29
PID 2372 wrote to memory of 1680	2372	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwLib.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 228
    3⤵
    - Program crash
    PID:1680