fa303eadc3cce05e0c0758c95d58e37be1ce42218f2a34392cd68eeff8ff487e

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 05:22

Target

$TEMP/downloader_easeus/2.0.0/12free/aliyun/AliyunWrap.dll
Size

476KB
MD5

1ff4ff46834cba11482fb5d0f8c533ab
SHA1

6295fbebf55542839454c1a54c3e00355f020043
SHA256

bc2f1685f7157336027d370718dd2428c8a3883450a6191979d22745c3bca7fc
SHA512

659604861088c164d53d87bad6bbd24ef01c539d63322da541de29b9d14398c484396b16f627d2fb32b6d9b934e7a4b4a25bcfecadf9d13a7db4d9e97086c583
SSDEEP

12288:LaK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0P/:Z9DeuBc/IPu8WMAF0P/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	2444	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2444	2416	rundll32.exe	28
PID 2416 wrote to memory of 2444	2416	rundll32.exe	28
PID 2416 wrote to memory of 2444	2416	rundll32.exe	28
PID 2416 wrote to memory of 2444	2416	rundll32.exe	28
PID 2416 wrote to memory of 2444	2416	rundll32.exe	28
PID 2416 wrote to memory of 2444	2416	rundll32.exe	28
PID 2416 wrote to memory of 2444	2416	rundll32.exe	28
PID 2444 wrote to memory of 2192	2444	rundll32.exe	29
PID 2444 wrote to memory of 2192	2444	rundll32.exe	29
PID 2444 wrote to memory of 2192	2444	rundll32.exe	29
PID 2444 wrote to memory of 2192	2444	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\2.0.0\12free\aliyun\AliyunWrap.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\2.0.0\12free\aliyun\AliyunWrap.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 256
    3⤵
    - Program crash
    PID:2192