5a20d291100cd26f8b1d80690873ec9b34a68e659e3561028fe0b752cdd8229d

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22/06/2024, 01:12

Target
!!newSetup_22334_P@ssKey!!/relay.dll
Size 1.5MB
Sample240622-bk2b7azerg
SHA256 5445b90053ca9c5c57ce4955bcc2a8b25da581cef94a69dad57404f6c3a89a0b
MD5 af8da0b55ec2a9a7f3b92ff3b8129556
SHA1 4a8acc4418fc6460511593919e7def2e40742381
SHA512 9f83b6914f08b5f592f4fd425f894966da35e604f766706ec554b68af931d8b1a0060387776c336794fede86a1d21a544458613de6f3bb695dfff777647e6f0b
SSDEEP 49152:L2gm39uH+I5/GxEoadcqX7Q9F7r40YB+eTcq+PDXx1lWz09x:3mtuH+e/RoadcqX7Qz7rDY8vq+Pbx1lc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2492	2184	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2092 wrote to memory of 2184	2092	rundll32.exe	28
PID 2184 wrote to memory of 2492	2184	rundll32.exe	29
PID 2184 wrote to memory of 2492	2184	rundll32.exe	29
PID 2184 wrote to memory of 2492	2184	rundll32.exe	29
PID 2184 wrote to memory of 2492	2184	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\!!newSetup_22334_P@ssKey!!\relay.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\!!newSetup_22334_P@ssKey!!\relay.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 248
    3⤵
    - Program crash
    PID:2492