990963b648cd37c166c5b9c884d3e59b3ef75b6ead16dd7430b9580141c16811

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 08:40

Target

c570598f4f6cb21fd1a7b998215f1514.dll
Size

7.6MB
MD5

c570598f4f6cb21fd1a7b998215f1514
SHA1

1451faa92b6da243c3651ff686ac30410a3ec236
SHA256

990963b648cd37c166c5b9c884d3e59b3ef75b6ead16dd7430b9580141c16811
SHA512

8b9fcf3603371f704a79bf20de77716ec47dd42e82a6729463797528195c13b6a218b00b68520ba0fd232d0d995412b58a056db70cd5163273c6331f7bd72f43
SSDEEP

196608:HNQez+UGF216GpEifNUBUJ1hnYwMr+39RIFwacGKjv:twk6mhuUHhTMrcJacGKT

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
25	5056	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1452	5056	WerFault.exe	99

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5056	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 5056	3496	rundll32.exe	99
PID 3496 wrote to memory of 5056	3496	rundll32.exe	99
PID 3496 wrote to memory of 5056	3496	rundll32.exe	99

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c570598f4f6cb21fd1a7b998215f1514.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c570598f4f6cb21fd1a7b998215f1514.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: RenamesItself
  PID:5056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 756
    3⤵
    - Program crash
    PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5056 -ip 5056
1⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1404 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:3092