563d0e670d8ff0fb4cdf870452b30e945ef34c01f9c4d41a52d44e0066d2ce6b

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 16:31

Target

Archivarius 3000/A3.dll
Size

163KB
MD5

0c80f5bcc11f67b5b5e036d9539f4432
SHA1

12f143eca39d39bd301fd0f7d5e9b79ed034597d
SHA256

529a2e81425b1c0fa76fb376d856f6650bfc714d6216dd8c6499bccaaaed871a
SHA512

a8b5544907f05ebe899270eff93b74464963f41c4beeab5c87f3eb509a9495005016d8799f7b32df330e8044e089fdb258650d99875b779255b5bba3431664c6
SSDEEP

3072:cIXzx+zxlmGEH3b6sAXMkIf/4a8ehLsdYEGrBQPF1IKnz2ImG/iLQLqhvCOJUDGZ:cVfmJXN48/p8eikrKFiKnz2ImwiR3oS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4700	4868	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 4868	3280	rundll32.exe	81
PID 3280 wrote to memory of 4868	3280	rundll32.exe	81
PID 3280 wrote to memory of 4868	3280	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Archivarius 3000\A3.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Archivarius 3000\A3.dll",#1
  2⤵
  PID:4868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 600
    3⤵
    - Program crash
    PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4868 -ip 4868
1⤵
PID:2904

memory/4868-0-0x00000000007B0000-0x0000000000854000-memory.dmp

Filesize
656KB

Download
memory/4868-1-0x00000000007B0000-0x0000000000854000-memory.dmp

Filesize
656KB

Download