f6e3d9034d0dfbb89293fd65389ab7c841de4fe37dc2de3a2f4fd3e0b2f4c0d0

Analysis

max time kernel
447s
max time network
1172s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
25/06/2024, 10:39

Target

KwishClient/resources/lwjgl_stb32.dll
Size

432KB
MD5

a0e616c8b75575f45497864d650005ec
SHA1

1c28819763f77cbb4593a95b1cbb0999f136695d
SHA256

1907bb0e022628fc624d7c3b002e9b79e056d789d6c7578f7f046ea414ac16d5
SHA512

04cba7e7fb2c87cf5f4a9ab6f68eb0f6e8d32c3841a0a68505d7b612f1a52387b423069fc3732036c5cbabc8e933c429f6d8820ad3d50b293d0fb2a06de3c83f
SSDEEP

6144:e9HIdmzLf0gDa0lhSSwGEZ5FIh/wqdmJsUWcZEfupWGhAOcsxz:6HI0Lf0SxlhSxG6gwYFUWVfIhKgz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5108	4020	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 4020	3120	rundll32.exe	77
PID 3120 wrote to memory of 4020	3120	rundll32.exe	77
PID 3120 wrote to memory of 4020	3120	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwishClient\resources\lwjgl_stb32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwishClient\resources\lwjgl_stb32.dll,#1
  2⤵
  PID:4020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 448
    3⤵
    - Program crash
    PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4020 -ip 4020
1⤵
PID:1612