f3613f5434d874490f600424a5c226cb36de3d8ce41a319f9321f4f845501ae0

Analysis

max time kernel
90s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 13:18

Target

$APPDATA/seemao/config/Common.dll
Size

219KB
MD5

e24fe22eb8f1d79ee950fc1a6efb1079
SHA1

73335d9a0db7d058ffe6a22d3ab3de9d3aacb64c
SHA256

21c0f0b476806e657c5094219411ab6715d294b75a3e45922ce11a29a18002a9
SHA512

b728d0eedbe8e6b63975f26a90080bb43b4f65d4f09c8dab6a4c15356cc17dcdd1d4f601cb48f41c78787c9f926d22857d027cc5a0f83ed5b70683827bf61040
SSDEEP

3072:hVJKdXOSqYf+0HOH3YUCD+YAeX7jfrT+btk9TBfCDUvtmSIVlIgP4:hVJwqYm03UCiPeXvTTQ29TBqDUNIjRP4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4316	3860	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3860	3980	rundll32.exe	84
PID 3980 wrote to memory of 3860	3980	rundll32.exe	84
PID 3980 wrote to memory of 3860	3980	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\Common.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\Common.dll,#1
  2⤵
  PID:3860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 632
    3⤵
    - Program crash
    PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3860 -ip 3860
1⤵
PID:2240