ad93e037fa69cb66bd757866fd38ed0eab0db89541b4739c302aec7e797f5ec4

Analysis

max time kernel
78s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2023, 16:50

Target

32bit/AssetsTools.dll
Size

793KB
MD5

5485e7451430ae6ae9398bc2d5ebdc00
SHA1

03e128dd41a8d8730f21548632a046c42bb57ca4
SHA256

a5874c4ff2275214f5a7293dfee63f48e986629bce81e38fc04ef9bae21822c2
SHA512

cb3439748f4eb7f407a2640601de6249ae10bbafe6a005bc29fb9821d067d30570e48c93b24ba89b2aeb532328efdaff629312efc713756dfbf407b0ec47e93d
SSDEEP

12288:/qCAyjEMNxOit3ccD+Jg0yIjMnty8BfqxDkYj41EjqCcyqUb31/ryQT:Ao3Oy/RZnty8BfqxDkYU1ETx/ryQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1240	1624	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1624	2320	rundll32.exe	79
PID 2320 wrote to memory of 1624	2320	rundll32.exe	79
PID 2320 wrote to memory of 1624	2320	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\AssetsTools.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\32bit\AssetsTools.dll,#1
  2⤵
  PID:1624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 616
    3⤵
    - Program crash
    PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1624 -ip 1624
1⤵
PID:3184