7a464be070d49cf0d53953907785917666e5ca38513a1a7a81b56edcdb7f15c8

Analysis

max time kernel
133s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 17:10

Target
sсriрts/binkawin.dll
Size 55KB
Sample240702-vpnrfasfpf
SHA256 dd68562b5e4686e1a07603057db7a12040821beadd81d142bfb6a57d2de45ddb
MD5 d51b5b46735b25c2d8372608159ed1a9
SHA1 2c178740901103d66a59131e19548d84c44fa768
SHA512 7c9a856fea8f7d4bddfc2b67724b475f7561979fbcf088ef2ce839e7c10870920ab4ea6b7d29254ab9d585a917eff5481c73644290350265682c627ab8fa110b
SSDEEP 1536:Ed01XORcuxj9ijJ644BXOpmE88Y+xs9PuMLHXwbJoeQ3fr:S0tOJxj9GJ644l2m78pm5uMLHX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2412	760	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 760	2464	rundll32.exe	83
PID 2464 wrote to memory of 760	2464	rundll32.exe	83
PID 2464 wrote to memory of 760	2464	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sсriрts\binkawin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\sсriрts\binkawin.dll,#1
  2⤵
  PID:760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 600
    3⤵
    - Program crash
    PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 760 -ip 760
1⤵
PID:4788