c735bc871b73fb5082795eaa26fc3f05a5e5d94abc4e527df55bceab30e79581

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 13:26

Target

bin/KwCommonUI.dll
Size

675KB
MD5

05618e59529922fb94fbebb597bf1be7
SHA1

acfefa3ff936ee6473c8f9b685da70089cb13191
SHA256

57141b7a64e7ced42e64a86dece1e042bbd3eaff066178bdf9f070d654774c17
SHA512

e5da1926943f77f3680da8b94498997fddf9bead75e33d97f802c5c5ee06bca556aca647b84768b99d0e49c44016ae009a57f78ff602506576b68e2887fe6181
SSDEEP

12288:MbMg2ffuJX3O23wTy05jSE1fOEHmKOfxV2wJ:zLK3UTFBfOixOfb2wJ

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Log	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3108	4160	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 4160	2644	rundll32.exe	81
PID 2644 wrote to memory of 4160	2644	rundll32.exe	81
PID 2644 wrote to memory of 4160	2644	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\KwCommonUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\KwCommonUI.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:4160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 716
    3⤵
    - Program crash
    PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4160 -ip 4160
1⤵
PID:3208

memory/4160-4-0x00000000021F0000-0x000000000221A000-memory.dmp

Filesize
168KB

Download
memory/4160-1-0x0000000002180000-0x00000000021C7000-memory.dmp

Filesize
284KB

Download
memory/4160-2-0x00000000021D0000-0x00000000021E2000-memory.dmp

Filesize
72KB

Download
memory/4160-6-0x0000000002250000-0x0000000002277000-memory.dmp

Filesize
156KB

Download
memory/4160-0-0x0000000000950000-0x000000000095D000-memory.dmp

Filesize
52KB

Download