fa303eadc3cce05e0c0758c95d58e37be1ce42218f2a34392cd68eeff8ff487e

Analysis

max time kernel
80s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 05:22

Target

$TEMP/downloader_easeus/2.0.0/12free/aliyun/AliyunWrap.dll
Size

476KB
MD5

1ff4ff46834cba11482fb5d0f8c533ab
SHA1

6295fbebf55542839454c1a54c3e00355f020043
SHA256

bc2f1685f7157336027d370718dd2428c8a3883450a6191979d22745c3bca7fc
SHA512

659604861088c164d53d87bad6bbd24ef01c539d63322da541de29b9d14398c484396b16f627d2fb32b6d9b934e7a4b4a25bcfecadf9d13a7db4d9e97086c583
SSDEEP

12288:LaK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0P/:Z9DeuBc/IPu8WMAF0P/

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3252	3516	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3516	640	rundll32.exe	81
PID 640 wrote to memory of 3516	640	rundll32.exe	81
PID 640 wrote to memory of 3516	640	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\2.0.0\12free\aliyun\AliyunWrap.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\2.0.0\12free\aliyun\AliyunWrap.dll,#1
  2⤵
  PID:3516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 672
    3⤵
    - Program crash
    PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3516 -ip 3516
1⤵
PID:2188