341a240b66dd9ff4ab13342e449ed3e7731482d40613ec35fc30e6df5bce9c29

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 18:19

Target

b8100ac7f49560c90e652a11624c08a8.dll
Size

95KB
MD5

b8100ac7f49560c90e652a11624c08a8
SHA1

6fc0d8d92a6e77d4b31cd4b6116bfa9e48585949
SHA256

341a240b66dd9ff4ab13342e449ed3e7731482d40613ec35fc30e6df5bce9c29
SHA512

9f1821912d2c35d50f94da2e7cc6c114bf611f9c86d43eb2e3181111c1171041082a463c6121842b8a6b0040b1ffc432d3cd940dc46c9bc47d2b228a75343cb2
SSDEEP

1536:iAnk4shzoW29JNYmmfAogDR2sNRSQ9YAOz+jMZPeERFaysktck0:iWqq9JNY9fZgl2sNbKesWERp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5484	5412	WerFault.exe	96

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5136 wrote to memory of 5412	5136	rundll32.exe	96
PID 5136 wrote to memory of 5412	5136	rundll32.exe	96
PID 5136 wrote to memory of 5412	5136	rundll32.exe	96

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8100ac7f49560c90e652a11624c08a8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b8100ac7f49560c90e652a11624c08a8.dll,#1
  2⤵
  PID:5412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 600
    3⤵
    - Program crash
    PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5412 -ip 5412
1⤵
PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:4296