39cdff6c5715ddf50fd2be798f948bf6a90e743a20c1d5fc0648269376af444b

Analysis

max time kernel
143s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 01:14

Target
CefSharp.BrowserSubprocess.Core.dll
Size 902KB
Sample240110-blz6hsccc6
SHA256 85579516863977128a7ca1fcbf3dcde4b583ce14ce7b4dcb2965f6ff07f1e74a
MD5 157f580c127db1e80a4eca85d2b49153
SHA1 34f44eb55c71c7282540d2161b121792c904ebac
SHA512 892e0d9fc493e9869ac53cd9bfecb334e84e22991e627f503866fbb39214269079bfbfab6a12a3ac0287b8c17eec5f303385fbdb4254614604c96d797d2c5294
SSDEEP 24576:GDJ7i2GjleANO/Pz8ELXILZ5S0veVRCl2ZiVBhEDssQjPc8DnXoSiW+Yf3x5XrQi:q4LZ5S0veVRCl2ZiVBhEDssQjPc8DnX9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4004	1540	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1540	1600	rundll32.exe	16
PID 1600 wrote to memory of 1540	1600	rundll32.exe	16
PID 1600 wrote to memory of 1540	1600	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CefSharp.BrowserSubprocess.Core.dll,#1
1⤵
PID:1540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 1292
  2⤵
  - Program crash
  PID:4004

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CefSharp.BrowserSubprocess.Core.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1540 -ip 1540
1⤵
PID:3080

memory/1540-0-0x0000000002AF0000-0x0000000002B00000-memory.dmp

Download

memory/1540-1-0x00000000052D0000-0x00000000053B6000-memory.dmp

Download

memory/1540-2-0x0000000069120000-0x00000000698D0000-memory.dmp

Download

memory/1540-3-0x0000000069120000-0x00000000698D0000-memory.dmp

Download