2ce267bc9f667c070be13be256344023b02850182cdb1e91b074464aafd78a9f

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 00:41

Target

iUnlock GSM Ramdisk/lib/.GASTER/.AppleMobileDeviceDFUMode/x86/winusbcoinstaller2.dll
Size

831KB
MD5

8e7b9f81e8823fee2d82f7de3a44300b
SHA1

1633b3715014c90d1c552cd757ef5de33c161dee
SHA256

ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c
SHA512

9ae37b2747589a0eb312473d895ef87404f4a395a27e15855826a75b4711ea934ca9a2b289df0abe0a8825dec2d5654a0b1603cf0b039fe25662359b730ce1a9
SSDEEP

12288:cZq3DFVAZjj5h7OqGDqY66s32+0SLqfhA50yWI7yBoM1oGloLwtxJYnPXrmQlT:cZwoP7MYG+pX501zBoC+wtxuPXrmQlT

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\setupact.log	rundll32.exe
File opened for modification	C:\Windows\setuperr.log	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process
2696	2692	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2692	2428	rundll32.exe	31
PID 2428 wrote to memory of 2692	2428	rundll32.exe	31
PID 2428 wrote to memory of 2692	2428	rundll32.exe	31
PID 2428 wrote to memory of 2692	2428	rundll32.exe	31
PID 2428 wrote to memory of 2692	2428	rundll32.exe	31
PID 2428 wrote to memory of 2692	2428	rundll32.exe	31
PID 2428 wrote to memory of 2692	2428	rundll32.exe	31
PID 2692 wrote to memory of 2696	2692	rundll32.exe	32
PID 2692 wrote to memory of 2696	2692	rundll32.exe	32
PID 2692 wrote to memory of 2696	2692	rundll32.exe	32
PID 2692 wrote to memory of 2696	2692	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\iUnlock GSM Ramdisk\lib\.GASTER\.AppleMobileDeviceDFUMode\x86\winusbcoinstaller2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\iUnlock GSM Ramdisk\lib\.GASTER\.AppleMobileDeviceDFUMode\x86\winusbcoinstaller2.dll",#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 248
    3⤵
    - Program crash
    PID:2696