4c736d1faacebb84bd437e13ebf1d1c0d615e1aabe55a0444d5d290a9e8d5c7c

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 21:33

Target

resources/app.asar.unpacked/node_modules/usb-detection/build/Release/detection.dll
Size

813KB
MD5

82b32a65634771bab7b4d606665f8e08
SHA1

bf22141119a83a2c4c5b8a543ee9676a6955d25a
SHA256

87665be6f26c6913b72152775383be59205510f982f379ee21b3c97a5c145964
SHA512

132b06b893dfcefa260b422ca607b5ea2f313688084259681176c3d85682fa8a27ee2bdfe4443f3a2c139abadfdcdc67e3c65d3ab19be639a25aa865ba74f801
SSDEEP

12288:WCMUmtd783v3okk5kf7mu6eRJnTSuESMQCLuMee2a5M0+:H0td783vYkk5O6e3TSSMnS0+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3040 2404 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3040	2404	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2960 wrote to memory of 2404	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2404	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2404	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2404	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2404	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2404	2960	rundll32.exe	rundll32.exe
PID 2960 wrote to memory of 2404	2960	rundll32.exe	rundll32.exe
PID 2404 wrote to memory of 3040	2404	rundll32.exe	WerFault.exe
PID 2404 wrote to memory of 3040	2404	rundll32.exe	WerFault.exe
PID 2404 wrote to memory of 3040	2404	rundll32.exe	WerFault.exe
PID 2404 wrote to memory of 3040	2404	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\usb-detection\build\Release\detection.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\app.asar.unpacked\node_modules\usb-detection\build\Release\detection.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 268
3⤵
- Program crash
PID:3040