83ce60348e07ef8e60a78b4954b90859584495ffc77fff3de3a2e1045499c0c2

Analysis

max time kernel
90s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 03:00

Target

AutoFireWall_701_20101107/SinoHttp.dll
Size

124KB
MD5

be539f20968644ad1c1a05ff70d2ed1a
SHA1

88ea217be29265c8570ccfeac43e83e6a46d0be0
SHA256

643c3df76def84cd96e7c3a7cb65983d510b964ac9f13b659920b9adee5d2d7d
SHA512

07e9a2542f63e00cfe3354668c6271a73b4bde1a4970e8c25bab9e680e589920e250f77452dde11fcc5c8edc3737e038a431568b7b9359db3c9f0e9c1efcc2b8
SSDEEP

1536:dRsOCa3VWTi9Kdaa+SXNr/6nyLTmisPUoIcK2eU79IIII/JzDDD/Ok:dyp2VFeavkr/88oIcxJ7xJzfL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	4664	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4664	4600	rundll32.exe	81
PID 4600 wrote to memory of 4664	4600	rundll32.exe	81
PID 4600 wrote to memory of 4664	4600	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoFireWall_701_20101107\SinoHttp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoFireWall_701_20101107\SinoHttp.dll,#1
  2⤵
  PID:4664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 648
    3⤵
    - Program crash
    PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4664 -ip 4664
1⤵
PID:4536