c4e6f9331755878841a23e1bc15def01e21a434f65c3ea5f978901faee26d13d

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240704-es
resource tags

arch:x64arch:x86image:win7-20240704-eslocale:es-esos:windows7-x64systemwindows
submitted
05-07-2024 14:11

Target

ch/luaclient-i386.dll
Size

186KB
MD5

bc07c7a4b44473183759be6f44f37678
SHA1

0737b1dcbf2fd2628a437d3b9274328ca210033c
SHA256

ef7328f5276b8d704327c41dcb9c5ce3713949222ba105a8a2cb4d21331cf7e6
SHA512

b444389707666a027789726e08334f619ddc51c08e1da87da4c8adbbe0bfd1a54089a4e98e065b82910fa758d465a6387c47ff67d6d9af550f9cf58c882642cd
SSDEEP

3072:jr03mcDwt5b2+z615yQ7SLVTnyJYpgerOEmgsRBZuz3zJ2YS:jg3mrHb2+z615yQ7GnyOpFOEFK4DQYS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1544	3036	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3036	2060	rundll32.exe	30
PID 2060 wrote to memory of 3036	2060	rundll32.exe	30
PID 2060 wrote to memory of 3036	2060	rundll32.exe	30
PID 2060 wrote to memory of 3036	2060	rundll32.exe	30
PID 2060 wrote to memory of 3036	2060	rundll32.exe	30
PID 2060 wrote to memory of 3036	2060	rundll32.exe	30
PID 2060 wrote to memory of 3036	2060	rundll32.exe	30
PID 3036 wrote to memory of 1544	3036	rundll32.exe	31
PID 3036 wrote to memory of 1544	3036	rundll32.exe	31
PID 3036 wrote to memory of 1544	3036	rundll32.exe	31
PID 3036 wrote to memory of 1544	3036	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ch\luaclient-i386.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ch\luaclient-i386.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 236
    3⤵
    - Program crash
    PID:1544