77f47300b9a3200911357446fcca87c60bbe1ed790c3f0e5b5da775164f67a2c

Analysis

max time kernel
141s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 12:24

Target

1176-55-0x0000000000180000-0x000000000018E000-memory.dll
Size

56KB
MD5

592035f21b021ece347aa4583bbe8f8f
SHA1

c0ef6fd0964489e9a8174e13233df026fbd1aaa0
SHA256

77f47300b9a3200911357446fcca87c60bbe1ed790c3f0e5b5da775164f67a2c
SHA512

7456247967fe1cb79d11defdc8631677c10f0aac0a93d783d8eeb49a822bede50ffed7994ce7361caadbebc7944d020da7e0d4f893958f8524538ac53c451b20
SSDEEP

1536:wi6qeSQiSCPALw/g8yH/cgownoJyCVDxGyxE2:6qeSjVPZ/fyH/TowosYGy

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2172 872 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2172	872	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4628 wrote to memory of 872	4628	rundll32.exe	rundll32.exe
PID 4628 wrote to memory of 872	4628	rundll32.exe	rundll32.exe
PID 4628 wrote to memory of 872	4628	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1176-55-0x0000000000180000-0x000000000018E000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4628

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1176-55-0x0000000000180000-0x000000000018E000-memory.dll,#1
2⤵
PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 560
3⤵
- Program crash
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 872 -ip 872
1⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4008 --field-trial-handle=3044,i,17059189006398306756,4247826696353232857,262144 --variations-seed-version /prefetch:8
1⤵
PID:4600