cc3fbfa0fa74fbc726e44e82698122ef072faba171c51b65c769b79b359d6790

Analysis

max time kernel
107s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 22:19

Target

$TEMP/MobileCertWin32.dll
Size

525KB
MD5

d30b8502aacf89aa5ab0cf1b24d55f11
SHA1

a7937ae4489aea3f3d19c1c04ad530c91db015f2
SHA256

7a617bc84155a4530bdd5d0a4e66f24d1b72e80b25080ae588ab7eeb56c64266
SHA512

b232cfe89f9e5f78c42dc7f5ea65b2a5767f50cb7f4450de739a110f97fec5e85dfffd33020355f6f2e99776c06f8fad41a700b2969e7d43a1921229ba693e8a
SSDEEP

3072:WlRrEUczk3fsF9Nn3ZknBNAjhKmsy8zP0Kss2GufKNQxJgKWJw+Znoi+pes92pkO:WlRreF/gag6IhQ8lP+pes92qG+wK7IB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
340	608	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 608	3016	rundll32.exe	18
PID 3016 wrote to memory of 608	3016	rundll32.exe	18
PID 3016 wrote to memory of 608	3016	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\MobileCertWin32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\MobileCertWin32.dll,#1
  2⤵
  PID:608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 664
    3⤵
    - Program crash
    PID:340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 608 -ip 608
1⤵
PID:3836

memory/608-1-0x00000000027F0000-0x0000000002872000-memory.dmp

Filesize
520KB

Download
memory/608-0-0x00000000027C0000-0x00000000027EB000-memory.dmp

Filesize
172KB

Download