5b4e091f4ff55c2d426ca3ab68714562387fb615b820bb32dd696a150f3330cd

Analysis

max time kernel
96s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 04:57

Target

x86/update.dll
Size

3.1MB
MD5

8fcfabdf2458336b061a06d7362f1c37
SHA1

ed669e2c73292d3a6510ed9d670bdf56cb7ca92d
SHA256

fc85d8cc5fe0327be1253c1f69ca48eaa30d9aa583becb6f1e678e7960e33022
SHA512

056eb2071e33efaa7ac52002a906008baf0f8c59f8fcc99c500510c327a6b2917922706c9ec05e12f716573d6d9321e28190f1a911f765d596fd4c0d4c882dec
SSDEEP

49152:Clg4XDo+apyPH5kscRzpBvMXBoHI1LFQQ2W9gtxWhToexMX+tPTqH8dO0t3z6XJh:Clg8oskscR/MRoHI1L0tiTVhqHuO0a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	5032	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 5032	3652	rundll32.exe	14
PID 3652 wrote to memory of 5032	3652	rundll32.exe	14
PID 3652 wrote to memory of 5032	3652	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\update.dll,#1
1⤵
PID:5032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 528
  2⤵
  - Program crash
  PID:2704

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\update.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5032 -ip 5032
1⤵
PID:2264