4c736d1faacebb84bd437e13ebf1d1c0d615e1aabe55a0444d5d290a9e8d5c7c

Analysis

max time kernel
126s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2024 21:33

Target

resources/app.asar.unpacked/node_modules/node-hid/build/Release/HID.dll
Size

832KB
MD5

c737d1d6503af7ef6adf57e3d2935853
SHA1

3669ceb541e17df66be61396e3345b630d19d82a
SHA256

31698f611727b442a40c9801d4cb09da9f1f075b8bf155098c65b5045862b375
SHA512

190a46fec037dd8919d11c6f8f79ec788ffb8594c9a31b4b85ebd6eadc9286eaa56f584bb165e99519afdb782c6b1ff3792a86c9b2e4b7432b336a2bd62a86a5
SSDEEP

12288:u+2nvZY1DPHyVrn2iS/lcW1vXvhKi4l0BTqEPCPVN4XTA6H9J+FM:u+2nviDPHyVrnqel05ZPC0XFH9d

Score

3^/10

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3484 4764 WerFault.exe rundll32.exe
2372 4764 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3484	4764	WerFault.exe	rundll32.exe
2372	4764	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1428 wrote to memory of 4764	1428	rundll32.exe	rundll32.exe
PID 1428 wrote to memory of 4764	1428	rundll32.exe	rundll32.exe
PID 1428 wrote to memory of 4764	1428	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-hid\build\Release\HID.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\node-hid\build\Release\HID.dll,#1
2⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 544
3⤵
- Program crash
PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 800
3⤵
- Program crash
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4764 -ip 4764
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4764 -ip 4764
1⤵
PID:3828