2769155d033b0441b80165f00a126db615ba18046ae0a952c9d145ee4ce1b0ae

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 07:23

Target

$APPDATA/24/remind/domains/u2l2000.dll
Size

22KB
MD5

6ec4efacbc97780df137830a7048eb84
SHA1

42baf27afbed37494c6dec64397bee989bee346b
SHA256

2dca9c28a3a056bf5a851bc0715da8f794a2c5663c2a55290fe802fb67eebf2a
SHA512

8a4951d17858b043ec279a322d54fa759f58e05237865ca7c7d93a60e253f2d7183d35581934561044a2b23b9aec64bb3bb3f9ec9977224c1621eccf75302475
SSDEEP

384:5w2rZdfNO4Pdc1YUo21/ar7jCDS+/hLCcY9jBJJ1lqI:5w27iSr747pL38TJ1lqI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3952	3888	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 3888	1084	rundll32.exe	94
PID 1084 wrote to memory of 3888	1084	rundll32.exe	94
PID 1084 wrote to memory of 3888	1084	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\24\remind\domains\u2l2000.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\24\remind\domains\u2l2000.dll,#1
  2⤵
  PID:3888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 604
    3⤵
    - Program crash
    PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3888 -ip 3888
1⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1320 --field-trial-handle=2268,i,4334050275411101233,11484630688883830558,262144 --variations-seed-version /prefetch:8
1⤵
PID:952