21e2a8a95af1c6e4c6fe804b1220ead3b2357667e436127f185bfff3d34b3b93

Analysis

max time kernel
147s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 09:53

Target

be4eaa2f12359200d8a1450e0cf37155.dll
Size

12KB
MD5

be4eaa2f12359200d8a1450e0cf37155
SHA1

97f0c76d41d82e49f303c45264b48494ef269748
SHA256

21e2a8a95af1c6e4c6fe804b1220ead3b2357667e436127f185bfff3d34b3b93
SHA512

5de4977c1d8969d6b3c0fdbaf71014d0e225a111d99c45c24923c34606e598147a13fbc24fe21660de8b4a9219865508849a1c500efe225a87cadf75ef4a2ca5
SSDEEP

192:NDOta3gLte01Yxx0R8fBaRbGFnBO1novHtVqI670fvX+2aOdp:snY01YnA8fBsynBO1nsD4wmwn

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3640	1356	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 1356	3192	rundll32.exe	94
PID 3192 wrote to memory of 1356	3192	rundll32.exe	94
PID 3192 wrote to memory of 1356	3192	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be4eaa2f12359200d8a1450e0cf37155.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be4eaa2f12359200d8a1450e0cf37155.dll,#1
  2⤵
  PID:1356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 548
    3⤵
    - Program crash
    PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1356 -ip 1356
1⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:8
1⤵
PID:232