fa303eadc3cce05e0c0758c95d58e37be1ce42218f2a34392cd68eeff8ff487e

Analysis

max time kernel
140s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 22:10

Target

$TEMP/downloader_easeus/2.0.0/12free/aliyun/AliyunWrap.dll
Size

476KB
MD5

1ff4ff46834cba11482fb5d0f8c533ab
SHA1

6295fbebf55542839454c1a54c3e00355f020043
SHA256

bc2f1685f7157336027d370718dd2428c8a3883450a6191979d22745c3bca7fc
SHA512

659604861088c164d53d87bad6bbd24ef01c539d63322da541de29b9d14398c484396b16f627d2fb32b6d9b934e7a4b4a25bcfecadf9d13a7db4d9e97086c583
SSDEEP

12288:LaK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0P/:Z9DeuBc/IPu8WMAF0P/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	4912	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4912	5112	rundll32.exe	83
PID 5112 wrote to memory of 4912	5112	rundll32.exe	83
PID 5112 wrote to memory of 4912	5112	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\2.0.0\12free\aliyun\AliyunWrap.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\2.0.0\12free\aliyun\AliyunWrap.dll,#1
  2⤵
  PID:4912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 672
    3⤵
    - Program crash
    PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4912 -ip 4912
1⤵
PID:4956