7f7e9c4eda4a83d113cc932cbe3ea3df1b73970885492ba441dc07f249ac02a1

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 01:09

Target

dbghelp.dll
Size

6.5MB
MD5

eb6d15d7d63e18c2400f7f6967680e58
SHA1

e6dcf1050ef8781000d374bcad78f4f25cad1d09
SHA256

0b8db5f6a7297966e9c557ce5eba1f00d598adec578ed3c7d774c0e4cf12692b
SHA512

34a47fe0744a45b997502c289b85e8342d8b9fd2adeb8b7f53740a588640e7c213ae1ef73e80d63302074052e63570bc284493c47d5dcd76ce7961382702ccb9
SSDEEP

98304:ZKttZRC6bkH0RFDyPl1KyE+tOtq/o5TgCFy:ZuWHw7+otqABgC

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1808	1364	WerFault.exe	86

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1364	2256	rundll32.exe	86
PID 2256 wrote to memory of 1364	2256	rundll32.exe	86
PID 2256 wrote to memory of 1364	2256	rundll32.exe	86
PID 1364 wrote to memory of 2740	1364	rundll32.exe	91
PID 1364 wrote to memory of 2740	1364	rundll32.exe	91
PID 1364 wrote to memory of 2740	1364	rundll32.exe	91
PID 1364 wrote to memory of 2740	1364	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbghelp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbghelp.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 764
    3⤵
    - Program crash
    PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1364 -ip 1364
1⤵
PID:3156

memory/1364-0-0x00000000026D0000-0x0000000002D5D000-memory.dmp

Filesize
6.6MB

Download
memory/1364-2-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Filesize
4KB

Download
memory/1364-3-0x00000000026D0000-0x0000000002D5D000-memory.dmp

Filesize
6.6MB

Download