0e7c4c6a9f29ceef5d38cfd3614005ba514fe61d0e175ff481516868f6ab7c40

Analysis

max time kernel
115s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 07:38

Target

ab5b4c3472f95d7ddef5f304079440cb.dll
Size

215KB
MD5

ab5b4c3472f95d7ddef5f304079440cb
SHA1

703c9700fdf12b9c1fa3c947bd17297295be4e1c
SHA256

0e7c4c6a9f29ceef5d38cfd3614005ba514fe61d0e175ff481516868f6ab7c40
SHA512

ff4ea0368cda46228b1ea5c69c04e45b3ccf6b6e27f76070dcae31df19b92bbcd8b7673bac8b3f2b1010ffc375df560c31431dd66ba117a3ae14527db1ad58f9
SSDEEP

3072:T9WwAcgQsSfAFtTjf63d0MevoQozODyrbhdepnAdmTcXvWXpXMdSyzhN:TBL+7TjmeMevoQSronAdmTk+XpXASYN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1196	2892	WerFault.exe	41

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2892	2924	rundll32.exe	41
PID 2924 wrote to memory of 2892	2924	rundll32.exe	41
PID 2924 wrote to memory of 2892	2924	rundll32.exe	41

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab5b4c3472f95d7ddef5f304079440cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ab5b4c3472f95d7ddef5f304079440cb.dll,#1
  2⤵
  PID:2892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 548
    3⤵
    - Program crash
    PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2892 -ip 2892
1⤵
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4012 --field-trial-handle=3044,i,17059189006398306756,4247826696353232857,262144 --variations-seed-version /prefetch:8
1⤵
PID:3620