b32d29bd92dd9667c4f9222468f363ba7cd3ffac3dac2d98b7a15e92fac0f057

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 00:10

Target
ad352be570ee91bcfbe599be9f5d99c8.dll
Size 19KB
Sample240229-age44sgh86
SHA256 b32d29bd92dd9667c4f9222468f363ba7cd3ffac3dac2d98b7a15e92fac0f057
MD5 ad352be570ee91bcfbe599be9f5d99c8
SHA1 fa51e6b0165ca41a63fab7b08be69624822e3e17
SHA512 c3d842c6160868abef6cd2e7c56e92192dcce0e7401f9f6d341040f27e3540ecf05e55d90e21610f8a0536e4be5f2a151b916065e0d8c3000812b6500c3fe66f
SSDEEP 384:zTUWtSLPhKCZbUu7gBe8HecxAXzuX47N8Nrh:zgWt8FZbU9xAB7N
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
904	1928	WerFault.exe	49

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 1928	3664	rundll32.exe	49
PID 3664 wrote to memory of 1928	3664	rundll32.exe	49
PID 3664 wrote to memory of 1928	3664	rundll32.exe	49

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad352be570ee91bcfbe599be9f5d99c8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad352be570ee91bcfbe599be9f5d99c8.dll,#1
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 560
    3⤵
    - Program crash
    PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1928 -ip 1928
1⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2588,i,14229658658073991926,6938034815163866135,262144 --variations-seed-version /prefetch:8
1⤵
PID:4476

memory/1928-0-0x0000000010000000-0x0000000010010000-memory.dmp

Download