d24d1726864be6bf4458f9c23ab89c03506bbb7d662cb68c27dff4c97e560e91

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 07:13

Target

bin/KwCommonUI.dll
Size

668KB
MD5

fb5d1d15560efc64692c98194e99492b
SHA1

de672e72089af85b16eac54650c77c1ba42f1c9c
SHA256

1f31d37384208ac409acbed501d80aeb0bb139cc51b2926014a5e1c78a5d80e7
SHA512

1663323226d083b44344064f431fc6827796e20af456feebffc248bd2137602b63e10b8f7c3f301024017f4b69f557967533124ec09de10a0ce41faa2d601f24
SSDEEP

12288:XhfRlA5ymiD2++z9kjPHC9KmhloBQ0R6G+4D9Zs7iJEprrhv:RH1x+Rk7SuX+4D9ZhurVv

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Log	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	4784	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 4784	4276	rundll32.exe	83
PID 4276 wrote to memory of 4784	4276	rundll32.exe	83
PID 4276 wrote to memory of 4784	4276	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\KwCommonUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\KwCommonUI.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:4784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 716
    3⤵
    - Program crash
    PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4784 -ip 4784
1⤵
PID:2120

memory/4784-0-0x0000000002660000-0x00000000026A7000-memory.dmp

Filesize
284KB

Download
memory/4784-6-0x0000000002720000-0x0000000002747000-memory.dmp

Filesize
156KB

Download
memory/4784-4-0x00000000026E0000-0x000000000270A000-memory.dmp

Filesize
168KB

Download
memory/4784-3-0x0000000000C90000-0x0000000000C9D000-memory.dmp

Filesize
52KB

Download
memory/4784-2-0x00000000026B0000-0x00000000026C2000-memory.dmp

Filesize
72KB

Download