ac4d89af582fa47bf8fe8e0190f52e35ec644a6ff447fdc40b26debc4d951b9f

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 11:10

Target

c5ba075c7b33c6043690c49e16012fcc.dll
Size

248KB
MD5

c5ba075c7b33c6043690c49e16012fcc
SHA1

bb4d712ca74a7b1045e894a76f3f0cc89b2ece99
SHA256

ac4d89af582fa47bf8fe8e0190f52e35ec644a6ff447fdc40b26debc4d951b9f
SHA512

f7ef38274457f586263159d177cfe538a312aa4bf867f953350d7031a88712e26698bbde3d3ed13f87abec2e06c8f3ac3dcaf0546c5c009d2fa4b7491b08fc3c
SSDEEP

3072:039/0XQTfHpM6KeQVkc4SoC7/Z/wu+6OiqDhoyekrhlu:HATpMJeskcxoCDONimoye2zu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5096	2028	WerFault.exe	95

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2028	2820	rundll32.exe	95
PID 2820 wrote to memory of 2028	2820	rundll32.exe	95
PID 2820 wrote to memory of 2028	2820	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5ba075c7b33c6043690c49e16012fcc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c5ba075c7b33c6043690c49e16012fcc.dll,#1
  2⤵
  PID:2028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 560
    3⤵
    - Program crash
    PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2028 -ip 2028
1⤵
PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3012

memory/2028-0-0x0000000010000000-0x000000001009E000-memory.dmp

Filesize
632KB

Download