c0c41aa0dfc14cc2c882f311841368559b75a38fe5ab1b6d13c5ac3a107f672c

Analysis

max time kernel
143s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 08:38

Target

b4463de32298aeba567e48562daec710.dll
Size

29KB
MD5

b4463de32298aeba567e48562daec710
SHA1

e298c013cede3ea72c68b332a9a139985a379de7
SHA256

c0c41aa0dfc14cc2c882f311841368559b75a38fe5ab1b6d13c5ac3a107f672c
SHA512

b2dcc23dc948bca8d484324f9c90fbf219cf4e89817a6a7937744af9dfc4daad5f211f5e9773bdbdd1f93cc4c70f2e853ebbae317bd3682f667b74733244611d
SSDEEP

384:WUnMA6iQCr+/I7KmicVzOKadirT5RJgg8HrqehZ57Gci/mO2utbh1iRw5Jp4nIu:NMTiLrX6cVOKauT5oPrtKmO29UJWJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2960	3440	WerFault.exe	95

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 3440	960	rundll32.exe	95
PID 960 wrote to memory of 3440	960	rundll32.exe	95
PID 960 wrote to memory of 3440	960	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4463de32298aeba567e48562daec710.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4463de32298aeba567e48562daec710.dll,#1
  2⤵
  PID:3440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 548
    3⤵
    - Program crash
    PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3440 -ip 3440
1⤵
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:960

memory/3440-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download