7961bc8263c6044a93dae4192dde5deb998e592f61932c2d23403c131e70780a

Analysis

max time kernel
137s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 21:50

Target

d7314139e33dd901b7d2fd540ed1748c.dll
Size

88KB
MD5

d7314139e33dd901b7d2fd540ed1748c
SHA1

7bc548b6fb7d53ae1d66d4ed34977c7f1ccec5da
SHA256

7961bc8263c6044a93dae4192dde5deb998e592f61932c2d23403c131e70780a
SHA512

bff9810b549bcd3fc11e19a33e0cb0703bd0beedd31816346cb240024331c4219d78374668ee1719907c41419148d5a48fb01bc12d796beb58b36f120d1aa910
SSDEEP

1536:pIKgRCXLJ3bHmnFQ9pniuQkfM7SAt4gj/C9xcpChSpYoJ3nJ3gGlbU4ag+kiNIPf:GKgI7J3bHh9lnuR4gj1CApYoJ3nJ3zvf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	4812	WerFault.exe	95

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 4812	3120	rundll32.exe	95
PID 3120 wrote to memory of 4812	3120	rundll32.exe	95
PID 3120 wrote to memory of 4812	3120	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7314139e33dd901b7d2fd540ed1748c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d7314139e33dd901b7d2fd540ed1748c.dll,#1
  2⤵
  PID:4812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 572
    3⤵
    - Program crash
    PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4812 -ip 4812
1⤵
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:1096

memory/4812-0-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download