99c2474f5bea6e3955d1002aa98678c32e9c0e9f2fb6d0c35d3a428ec279d103

Analysis

max time kernel
138s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:44

Target

x86/update.dll
Size

3.1MB
MD5

8fcfabdf2458336b061a06d7362f1c37
SHA1

ed669e2c73292d3a6510ed9d670bdf56cb7ca92d
SHA256

fc85d8cc5fe0327be1253c1f69ca48eaa30d9aa583becb6f1e678e7960e33022
SHA512

056eb2071e33efaa7ac52002a906008baf0f8c59f8fcc99c500510c327a6b2917922706c9ec05e12f716573d6d9321e28190f1a911f765d596fd4c0d4c882dec
SSDEEP

49152:Clg4XDo+apyPH5kscRzpBvMXBoHI1LFQQ2W9gtxWhToexMX+tPTqH8dO0t3z6XJh:Clg8oskscR/MRoHI1L0tiTVhqHuO0a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	672	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 672	3332	rundll32.exe	76
PID 3332 wrote to memory of 672	3332	rundll32.exe	76
PID 3332 wrote to memory of 672	3332	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\update.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\update.dll,#1
  2⤵
  PID:672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 528
    3⤵
    - Program crash
    PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 672 -ip 672
1⤵
PID:920