93a223f67ba729705d01ac05eb994be3e7fbe061e6e40909996964be1d0cb944

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 23:58

Target

cc9546d55cf2e8381906d81570aafaa9.dll
Size

30KB
MD5

cc9546d55cf2e8381906d81570aafaa9
SHA1

d88cfbecbef7f7043afde5ee6e42169eb8871bd4
SHA256

93a223f67ba729705d01ac05eb994be3e7fbe061e6e40909996964be1d0cb944
SHA512

660e66e0c9daef96a65b088b5afc118fe4ee8dadd9a5b669f7fbe59c4899105b1a47bd95fd72159b4edc4b590a3ad3bd294d94399b4aa5b9eed39f3e9422522a
SSDEEP

384:JG257CHrq/6vgvJYuBhrNz3q0F15WuQicqDTzpDKaJcULHbqqOsRumSfhVsXmze9:J4u/TvJYuLNHIkNLb5LepVymzel07eU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3748	5020	WerFault.exe	93

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 5020	2532	rundll32.exe	93
PID 2532 wrote to memory of 5020	2532	rundll32.exe	93
PID 2532 wrote to memory of 5020	2532	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc9546d55cf2e8381906d81570aafaa9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cc9546d55cf2e8381906d81570aafaa9.dll,#1
  2⤵
  PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 548
    3⤵
    - Program crash
    PID:3748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5020 -ip 5020
1⤵
PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2700,i,14629483171127516024,12350888228055326066,262144 --variations-seed-version /prefetch:8
1⤵
PID:852