e0da8778f07976499c543e9a4c359034d098de7aefd58121942a637f790bd565

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 03:05

Target

e0da8778f07976499c543e9a4c359034d098de7aefd58121942a637f790bd565.dll
Size

76KB
MD5

67e2f09b14b3520e11fa35e933a4496b
SHA1

f9fe7759cffa71c356ba0715ea08772410868563
SHA256

e0da8778f07976499c543e9a4c359034d098de7aefd58121942a637f790bd565
SHA512

e59299fc8100f07565c1eb38d192082dff7a4a04975a7f8b299037df0f0f81078e869f687322a388b06849df8282e6295750c927a60c87368fb73e5955fa19f4
SSDEEP

1536:/bdbcDvPksflPF+YA7pxprlngtT+Q/tGMwK7tYuK2pMi8:zdZsf3opxT+/tscii8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3760	1616	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 1616	3688	rundll32.exe	94
PID 3688 wrote to memory of 1616	3688	rundll32.exe	94
PID 3688 wrote to memory of 1616	3688	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0da8778f07976499c543e9a4c359034d098de7aefd58121942a637f790bd565.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e0da8778f07976499c543e9a4c359034d098de7aefd58121942a637f790bd565.dll,#1
  2⤵
  PID:1616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 544
    3⤵
    - Program crash
    PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1616 -ip 1616
1⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:748

memory/1616-0-0x0000000000C30000-0x0000000000C41000-memory.dmp

Filesize
68KB

Download