f032591ff92ac9f36254adcab78f85d13f6c7559ecd0e7cb782d3c49db70ca1b

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 23:56

Target

nEO iMAGING/easysnap.dll
Size

148KB
MD5

000300649d8cfd9c7d71d1b10a9bec03
SHA1

f1150afb173d8ceb40ee38e6ae634e6ec7c218f5
SHA256

f1084b70625ba7f4e626087d2319a4022c1990ddcf5d6c47c65ac2218841a433
SHA512

9c1d27ea980c1af87c6219d05e80508a02ab378a4ee8c9f99054baa4d4e705e77445e873375f49547a2cd6efb261b43e866a1557f364bf20ac9b3c7918968501
SSDEEP

1536:gvdbXWA+37Wgu6up7V/aRui0z5jq7nWyyrj2R+2Gm/j1c1w51vtmgMbFuZ0tfH5p:eGUgRu+Ofm5c1w5FAg0FuGtfHX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2436	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2436	2204	rundll32.exe	86
PID 2204 wrote to memory of 2436	2204	rundll32.exe	86
PID 2204 wrote to memory of 2436	2204	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\easysnap.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\easysnap.dll",#1
  2⤵
  PID:2436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 600
    3⤵
    - Program crash
    PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2436 -ip 2436
1⤵
PID:4896