595f4fc0f66cfba69430aad00411be104f37958edbbbb773a105b2b9f06f6fa8

Analysis

max time kernel
150s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 05:27

Target

$LOCALAPPDATA/Salad/workloads/gpuz/clrgc.dll
Size

420KB
MD5

58ccec88f3a96bc236b4f76fa3ae8b1d
SHA1

1035acca88ed26a0ab8830b047e94514dd4bbbb9
SHA256

7da076b28ce05595dcbccd618b1a487922f33572dbe8914766e114eec7603720
SHA512

aa14e67fd1f376dfe4a9b119e07e0afeade563bf10077f4787314adc8335832fb81fb2834e0d40cbaf34c111acb1ac0b747142f54e6e3c4f22c15aedd0f340c2
SSDEEP

6144:trAf2NFmdxkWAbHUCG3XQFTJlC1zcXjmOBUOKCGyZlFZZE5zQGwBQJGcquJe/pja:uf2exkWAb0CFXotOKCvlDGgFcpia

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4600	836	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 836	3340	rundll32.exe	90
PID 3340 wrote to memory of 836	3340	rundll32.exe	90
PID 3340 wrote to memory of 836	3340	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\Salad\workloads\gpuz\clrgc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\Salad\workloads\gpuz\clrgc.dll,#1
  2⤵
  PID:836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 612
    3⤵
    - Program crash
    PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 836 -ip 836
1⤵
PID:4316