8244d3c049d38b92198166cd4f16d6a77f67c731fd157683c25decf4e699867e

Analysis

max time kernel
142s
max time network
271s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
16-04-2024 19:36

Target

modules/coresys32.dll
Size

552KB
MD5

0368dc708c4beb959655df57fb977d07
SHA1

3cb5b8dd033d53014ed119187f3f75a44931be74
SHA256

22e16760928fdb928c473a71323286e7ce467e909e3953baba3dac53b6b9d966
SHA512

5e2b12911ae94433820a7c3405bcc26837228b2164d4be2f8574e843c18b84bf01366855b28e58a41afd3a7b79fd29f8ffa6251390ae0217eb585aa215473d95
SSDEEP

12288:lyZbN6/R1kdzE0BkDVoXmsUqDAf+UW0avTb28gvHjeiC7joOl90UucxKs4:l8N2izE0K0msUqDAf+UW0avTb28kq8kE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	1324	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1324	1580	rundll32.exe	82
PID 1580 wrote to memory of 1324	1580	rundll32.exe	82
PID 1580 wrote to memory of 1324	1580	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\modules\coresys32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\modules\coresys32.dll,#1
  2⤵
  PID:1324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 580
    3⤵
    - Program crash
    PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1324 -ip 1324
1⤵
PID:4268