46a2ef76412b88068194c79780e29ac7307831849da46b189567b11c87b678b7

Analysis

max time kernel
135s
max time network
143s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20-04-2024 10:39

Target

Crystal disk/CdiResource/dll/JMS56x86.dll
Size

192KB
MD5

f0cfd97b1ebe069f424c116843231183
SHA1

e5e921a0ba07b96b1dc5c21c22bee815615cfe48
SHA256

fd750e8a7ebea0e61a04cf7ef65aaabbb6e0d3c07b64ebd2df18170c8fcf5347
SHA512

48beb5b2bf84fd1b61335fc6c06463efe861a9bdf500d32fc62e89b8eb65f6966c379c9b94a34b20051e792ccb1460ad7d658474269a8848314806265ca3793c
SSDEEP

3072:xeCx6ZaMCvvzgGC8OcRG8ogkVrcAku/h4OFgs9YTMhd1FXDrsjbWJoIuye2zcXUE:wCx6ZaMCvvctPcois9Wa1ZAjbNzU1Rc

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3588 3140 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3588	3140	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2452 wrote to memory of 3140	2452	rundll32.exe	rundll32.exe
PID 2452 wrote to memory of 3140	2452	rundll32.exe	rundll32.exe
PID 2452 wrote to memory of 3140	2452	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crystal disk\CdiResource\dll\JMS56x86.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Crystal disk\CdiResource\dll\JMS56x86.dll",#1
2⤵
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 620
3⤵
- Program crash
PID:3588