397ff48f9ae2034c72bb9428427fbf6eca8df5b215723ba31094cf323f32df5e

Analysis

max time kernel
94s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 05:58

Target

$APPDATA/Hotspot Shield/report/af_proxy.dll
Size

934KB
MD5

3388d55bc7d9eb92982d342299910494
SHA1

1aa8fb72c4fc2f2d7e9e3824a11092701662efb9
SHA256

ac0c99a3ae9be803993d7ec8e346d62477425f591eb7c4854d4a0a3c0a1c2a45
SHA512

51742f95f3b710229e13e429fd737a114e8f10ca7c73ad6307059dd6ade58da7a7e470274467f91ba63654c738fd87eb255573f9bc851a8df4b034297df04f7f
SSDEEP

24576:BbCNa0PsR7NPEHnWP+OUnAi24X1+u8vvW:W6uHnWP4AwX8lvO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	1572	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1572	1720	rundll32.exe	84
PID 1720 wrote to memory of 1572	1720	rundll32.exe	84
PID 1720 wrote to memory of 1572	1720	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\Hotspot Shield\report\af_proxy.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$APPDATA\Hotspot Shield\report\af_proxy.dll",#1
  2⤵
  PID:1572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 652
    3⤵
    - Program crash
    PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1572 -ip 1572
1⤵
PID:1564

memory/1572-0-0x0000000061B80000-0x0000000061B98000-memory.dmp

Filesize
96KB

Download