729f3b57b327bf72e25a6caf13cbfbeeda92cb34a463ea02fec2112a3fdbcb58

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 14:22

Target

bc06f48e9f710024cbdab61ad516bbda.dll
Size

690KB
MD5

bc06f48e9f710024cbdab61ad516bbda
SHA1

e0c75514a6f1675b6a55cb4b2711283ba09ad763
SHA256

729f3b57b327bf72e25a6caf13cbfbeeda92cb34a463ea02fec2112a3fdbcb58
SHA512

a644a02d0d5ed4ae55a5bfe772001066f33683e7868e03eedc4fc3944bdb773d9be05ca47aa38314b456c78e8725ebecb24e93dd8603c6de7689ff3c3c00274b
SSDEEP

12288:1V12dCZ2Vqwjqy/S0zsJoX7zGhT7LVsViYCjb3uu21NQ8JJlj:1X2EoVqKl5yoX7KhzWSHun1y2j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3696	4480	WerFault.exe	95

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4480	2964	rundll32.exe	95
PID 2964 wrote to memory of 4480	2964	rundll32.exe	95
PID 2964 wrote to memory of 4480	2964	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc06f48e9f710024cbdab61ad516bbda.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bc06f48e9f710024cbdab61ad516bbda.dll,#1
  2⤵
  PID:4480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 628
    3⤵
    - Program crash
    PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4480 -ip 4480
1⤵
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1712 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:2572

memory/4480-0-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download
memory/4480-1-0x0000000000400000-0x00000000005CE000-memory.dmp

Filesize
1.8MB

Download