9c3dd40b4539a812baabc3b8e1cec9ae45a39ec8d799c1bd6e53d9d64a2366f0

Analysis

max time kernel
139s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 11:55

Target

$_27_/Auburn Sounds Graillon 2.dll
Size

2.4MB
MD5

9b6953c41811355a418269e4fcf3ee4d
SHA1

629e470a051ebf84b53eb0819238f8e2c60a2929
SHA256

33bb3fabe7c08cd9ebf5f5aded545720bc9628aee89debbbf676e38af8f20818
SHA512

129f4a25109b1311ee90e963c3d9d11cc5fd9d414d1e5989cac2f826c4b0b3273239b8690259f6ba55a568ef38f4424c898f4f37fa80702917773f5a2e77eb5b
SSDEEP

24576:nKzMoNy9b5HRrd+3xZEVrL3HxOYOYPqfxpluPTW0Gxk/q8PeWHqbP7VqzAbqsOGj:nK3Yb/yEexU3hBHqbDVq7V0Y/UP+LNjQ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1720 4016 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1720	4016	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2156 wrote to memory of 4016	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 4016	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 4016	2156	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$_27_\Auburn Sounds Graillon 2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$_27_\Auburn Sounds Graillon 2.dll",#1
2⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 632
3⤵
- Program crash
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4256 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4016 -ip 4016
1⤵
PID:3124