0bdc115aef8d58d2268275c231838e9cbd0c0b2a341fce80472f6ec83cf3e3fb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 07:03

Target

Recover My Files v4/PascalStreams.dll
Size

86KB
MD5

f66737c4cc655fbcf28b2b73e4f4645c
SHA1

804ae5192ba20de23a4650ba336cb1f7e11a4926
SHA256

6d9ae4bf7fc2b01666e2d2ad3d0e4ea84ac4a260e7465062c024ef5b2574c566
SHA512

2e24a0ba43b1e4fc4d1599554e112afa8ef336c2e108f6cbefc76e8366f6801cd92d704e0a6bc0033ab2be50705db7b333e0bb9df6dcf201a72119c91491ffc8
SSDEEP

1536:pjqjoQTOKuovbvTspOaQcNFeSe4Edi3sXxC7gCKKmvXlu3mvj7dHUA9:8obtgvssanNFeS9EM3IxC7gCKdvVHvfH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4588	768	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 768	4892	rundll32.exe	82
PID 4892 wrote to memory of 768	4892	rundll32.exe	82
PID 4892 wrote to memory of 768	4892	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Recover My Files v4\PascalStreams.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Recover My Files v4\PascalStreams.dll",#1
  2⤵
  PID:768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 632
    3⤵
    - Program crash
    PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 768 -ip 768
1⤵
PID:368

memory/768-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download