f6e3d9034d0dfbb89293fd65389ab7c841de4fe37dc2de3a2f4fd3e0b2f4c0d0

Analysis

max time kernel
447s
max time network
1172s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
25-06-2024 10:39

Target

KwishClient/resources/lwjgl_stb32.dll
Size

432KB
MD5

a0e616c8b75575f45497864d650005ec
SHA1

1c28819763f77cbb4593a95b1cbb0999f136695d
SHA256

1907bb0e022628fc624d7c3b002e9b79e056d789d6c7578f7f046ea414ac16d5
SHA512

04cba7e7fb2c87cf5f4a9ab6f68eb0f6e8d32c3841a0a68505d7b612f1a52387b423069fc3732036c5cbabc8e933c429f6d8820ad3d50b293d0fb2a06de3c83f
SSDEEP

6144:e9HIdmzLf0gDa0lhSSwGEZ5FIh/wqdmJsUWcZEfupWGhAOcsxz:6HI0Lf0SxlhSxG6gwYFUWVfIhKgz

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5108 4020 WerFault.exe rundll32.exe

pid	pid_target	process	target process
5108	4020	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3120 wrote to memory of 4020	3120	rundll32.exe	rundll32.exe
PID 3120 wrote to memory of 4020	3120	rundll32.exe	rundll32.exe
PID 3120 wrote to memory of 4020	3120	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwishClient\resources\lwjgl_stb32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3120

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KwishClient\resources\lwjgl_stb32.dll,#1
2⤵
PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 448
3⤵
- Program crash
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4020 -ip 4020
1⤵
PID:1612