341f97e83e1ccfe0a11dc3211ae5d1211268ac63c9b6c2c778b3b4ae60864e55

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2024 09:30

Target

15 Cable 4.0/INETWH32.dll
Size

48KB
MD5

08040e0bbf8ce1e9cfa7dc99affebb7f
SHA1

ff0eabff722aef85535f3fd730bae0abb1d9d51a
SHA256

4a9c61bc942fdcfcb2eec8234b04d32aca4b25c086b5b03af8bc22b3596bfe85
SHA512

4c51d4451166f659adfa43c0b4537af9716b5b2e74af7459577fe5b77a6f68051a34a13e49bc6ce6f93c0dbb7ec64c599a9d43f4e0e6a79664e3805fb7d2ebc5
SSDEEP

768:gNapYVbGZITogAr2a98SaNJfVWALlTH4DWxfWa22OZcIYYoyNFhZ9CF0htssaH:7GVb41gA/PIWgTH4DWxfWaE/Po3+tsZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3996 4264 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3996	4264	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1980 wrote to memory of 4264	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 4264	1980	rundll32.exe	rundll32.exe
PID 1980 wrote to memory of 4264	1980	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\15 Cable 4.0\INETWH32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\15 Cable 4.0\INETWH32.dll",#1
2⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 624
3⤵
- Program crash
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4264 -ip 4264
1⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:1484