271de5aed87a398dedf889c16d7927e90f07facb4774a073cd4f365073fe51f8

Resubmissions

29-02-2024 21:17

max time kernel
150s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 21:17

Target

AutoUpdate/AutoUpdateUtil.dll
Size

198KB
MD5

d585f6453c8f564da8db0573ee311e0e
SHA1

81df64177e63f98ceb9f6a4e0f002493abfc1e57
SHA256

ef09b83ce0becbae769a323037e8cd9922a1f57f3fe0fd1f92957cea232f4913
SHA512

a5973907c6ab1fa956a76a107957d59952a49b190c1e4dd82b7c49796516b896d59e256dd94ca0bf56d088dabe53d1681ebfeda3405dc47646c1c33d461dd153
SSDEEP

3072:dOq3B8kyfQQC2mC2gbvCsGowP96rH0Vu3b1vJ4gMdzeVj+3O1fnMw:Qq3BJ4vCCa9Vgxl+GvM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4924	2448	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2448	3440	rundll32.exe	94
PID 3440 wrote to memory of 2448	3440	rundll32.exe	94
PID 3440 wrote to memory of 2448	3440	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdateUtil.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdateUtil.dll,#1
  2⤵
  PID:2448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 612
    3⤵
    - Program crash
    PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2448 -ip 2448
1⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1040 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:3112