bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 08:19

Target

MedicareSign/astprint.dll
Size

14KB
MD5

02f50ce43aa143a0a933036d4897879e
SHA1

0cc00f804fb902f7420fcbe8633a0991c7e1f49c
SHA256

9b1231d03c4cc88cca0dd224cb4059e2cfadeff9a5ef9f082c1da99e4ca95360
SHA512

da7573f2cb76798fc4845284857540cf4093228084f30b9230497268fd6a5e60a9246b63a5915b3dd192e60143e4fc17427d6c316392de1be60071dec57d686f
SSDEEP

192:J8QxCQybcQQybzW6kwCiEHio27aefHix86Tq7Y4odAUhUZQwg2G4lYqufZnIcfx:PVkntCi0GtCxXBhge4GfZIcfx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4696	2120	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2120	2144	rundll32.exe	84
PID 2144 wrote to memory of 2120	2144	rundll32.exe	84
PID 2144 wrote to memory of 2120	2144	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\astprint.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\astprint.dll,#1
  2⤵
  PID:2120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 996
    3⤵
    - Program crash
    PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2120 -ip 2120
1⤵
PID:3508

memory/2120-0-0x0000000002B30000-0x0000000002B40000-memory.dmp

Filesize
64KB

Download
memory/2120-1-0x0000000074EFE000-0x0000000074EFF000-memory.dmp

Filesize
4KB

Download
memory/2120-2-0x0000000002D60000-0x0000000002D6A000-memory.dmp

Filesize
40KB

Download
memory/2120-3-0x0000000075830000-0x000000007583A000-memory.dmp

Filesize
40KB

Download