d521ac0c1bedc9fbaa53cb57fffbe4ca7e1ff45d4b2508c14d8b9ae44c8d6a06

Analysis

max time kernel
137s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 14:17

Target

d521ac0c1bedc9fbaa53cb57fffbe4ca7e1ff45d4b2508c14d8b9ae44c8d6a06.dll
Size

1.3MB
MD5

b8f1dffb6f7d941f68af0fd3e9b2d62b
SHA1

11f66f050551cbccd6cf6a074b70bcf5485519af
SHA256

d521ac0c1bedc9fbaa53cb57fffbe4ca7e1ff45d4b2508c14d8b9ae44c8d6a06
SHA512

4edb044c9e148f3b5c05d54f403437ab59110e3e01dda4535a4611662ec6574b02e15f77e746d1283e0385c9f70cd2416b0ed33bc53fae34b08b8d7e0380d17a
SSDEEP

24576:3RT0EtXhsVDLgQsSulh2Z6ytyFJpckYatFaC4sg2F2eB91hmcH32+6bKstEBrEHf:BYEXsN9clsZQplrdg2EeZQcH3+tEQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
696	1504	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 1504	3588	rundll32.exe	92
PID 3588 wrote to memory of 1504	3588	rundll32.exe	92
PID 3588 wrote to memory of 1504	3588	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d521ac0c1bedc9fbaa53cb57fffbe4ca7e1ff45d4b2508c14d8b9ae44c8d6a06.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d521ac0c1bedc9fbaa53cb57fffbe4ca7e1ff45d4b2508c14d8b9ae44c8d6a06.dll,#1
  2⤵
  PID:1504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 560
    3⤵
    - Program crash
    PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1504 -ip 1504
1⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4900