ed17de99168a5170f462b4e9edda4777afb738b3a1d963de5a20bea4f431a045

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 04:56

Target

ed17de99168a5170f462b4e9edda4777afb738b3a1d963de5a20bea4f431a045.dll
Size

138KB
MD5

8c0338171792a91d11f825b85ba31465
SHA1

053e0933bde0e32b621f6e119908a874cfc5bb3d
SHA256

ed17de99168a5170f462b4e9edda4777afb738b3a1d963de5a20bea4f431a045
SHA512

5a079b108244fa0c5e27f9612c5f9511f90e0ac84c96bbbfb3d74603dc429d6cfa745b4105d107667e1b6f66a2c29b98074e718462c1a0ce834a0623ed099292
SSDEEP

768:ICkiZEhtWI77LQp/eNGFJk3E0feSUpdmmJiiOLysR5c72klId:JZdshHdfTUpdmmJ2PR5c72uId

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
444	4760	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4760	4256	rundll32.exe	92
PID 4256 wrote to memory of 4760	4256	rundll32.exe	92
PID 4256 wrote to memory of 4760	4256	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed17de99168a5170f462b4e9edda4777afb738b3a1d963de5a20bea4f431a045.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed17de99168a5170f462b4e9edda4777afb738b3a1d963de5a20bea4f431a045.dll,#1
  2⤵
  PID:4760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 612
    3⤵
    - Program crash
    PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4760 -ip 4760
1⤵
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:2900

memory/4760-0-0x0000000075360000-0x0000000075373000-memory.dmp

Filesize
76KB

Download