d24d1726864be6bf4458f9c23ab89c03506bbb7d662cb68c27dff4c97e560e91

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 07:13

Target

bin/KwCommonUI.dll
Size

668KB
MD5

fb5d1d15560efc64692c98194e99492b
SHA1

de672e72089af85b16eac54650c77c1ba42f1c9c
SHA256

1f31d37384208ac409acbed501d80aeb0bb139cc51b2926014a5e1c78a5d80e7
SHA512

1663323226d083b44344064f431fc6827796e20af456feebffc248bd2137602b63e10b8f7c3f301024017f4b69f557967533124ec09de10a0ce41faa2d601f24
SSDEEP

12288:XhfRlA5ymiD2++z9kjPHC9KmhloBQ0R6G+4D9Zs7iJEprrhv:RH1x+Rk7SuX+4D9ZhurVv

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Log	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	1716	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1716	2512	rundll32.exe	28
PID 2512 wrote to memory of 1716	2512	rundll32.exe	28
PID 2512 wrote to memory of 1716	2512	rundll32.exe	28
PID 2512 wrote to memory of 1716	2512	rundll32.exe	28
PID 2512 wrote to memory of 1716	2512	rundll32.exe	28
PID 2512 wrote to memory of 1716	2512	rundll32.exe	28
PID 2512 wrote to memory of 1716	2512	rundll32.exe	28
PID 1716 wrote to memory of 2192	1716	rundll32.exe	29
PID 1716 wrote to memory of 2192	1716	rundll32.exe	29
PID 1716 wrote to memory of 2192	1716	rundll32.exe	29
PID 1716 wrote to memory of 2192	1716	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\KwCommonUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\KwCommonUI.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 280
    3⤵
    - Program crash
    PID:2192

memory/1716-1-0x00000000001B0000-0x00000000001F7000-memory.dmp

Filesize
284KB

Download
memory/1716-2-0x0000000000200000-0x000000000020D000-memory.dmp

Filesize
52KB

Download
memory/1716-3-0x0000000000220000-0x0000000000247000-memory.dmp

Filesize
156KB

Download
memory/1716-5-0x00000000002A0000-0x00000000002B2000-memory.dmp

Filesize
72KB

Download
memory/1716-6-0x00000000002D0000-0x00000000002FA000-memory.dmp

Filesize
168KB

Download