96d8cc815f3da859b3d57c86e04c15dcde2082272fbfe66154fd487f0e9ff19d

Analysis

max time kernel
159s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 01:02

Target

d786c727bb1666d3b139860658407363.dll
Size

42KB
MD5

d786c727bb1666d3b139860658407363
SHA1

dd45c923476642356479913e2e8eb22d6d49836a
SHA256

96d8cc815f3da859b3d57c86e04c15dcde2082272fbfe66154fd487f0e9ff19d
SHA512

a19d41eb35a8e53d42804f94ff729ac140643a0493f52e3df2bab87dcf16b3b018feab0de8986a8b4c2cf0b538cc0264c6679fc091bb358b2159c5b192daa2fe
SSDEEP

768:tE1obGm7B9iFLFjPjCkN95r8r2k1/+SJOydXm1o9Iv:m1gB9iFL57D9MV1/+6h2o2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	3252	WerFault.exe	93

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3252	2980	rundll32.exe	93
PID 2980 wrote to memory of 3252	2980	rundll32.exe	93
PID 2980 wrote to memory of 3252	2980	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d786c727bb1666d3b139860658407363.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d786c727bb1666d3b139860658407363.dll,#1
  2⤵
  PID:3252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3252 -s 800
    3⤵
    - Program crash
    PID:2676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3252 -ip 3252
1⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2256,i,6057863739127169200,6895476048812676039,262144 --variations-seed-version /prefetch:8
1⤵
PID:2332

memory/3252-0-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/3252-1-0x0000000002A90000-0x0000000002B66000-memory.dmp

Filesize
856KB

Download
memory/3252-2-0x0000000002A90000-0x0000000002B66000-memory.dmp

Filesize
856KB

Download