cdd9213c986f4dcc1f2c07f584d564c6a3ba00c9c27fe016bf51fd70ff0ef973

Analysis

max time kernel
65s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 23:01

Target

api-ms-win-crt-filesystem-l1-1-0.dll
Size

13KB
MD5

4ec243792d382305db59dc78b72d0a1e
SHA1

63b7285646c72ee640d34cdc200bfc5863db3563
SHA256

56e0bdf91edb21f5f5041f052723025c059a11360bb745f965a9903de9c61756
SHA512

88f648d45927db65ff8cead4bb1959b1297410bf3f5b3b2783a173d708649260a61470342694de8b93e9c1657de64db43db40ee71acc661b03786c0921d68d4b
SSDEEP

192:b7q6nWlC0i5C5WOhWWT71ojDBQABJHTTKJqnajLQvTP+8jIrF7:/q6nWm5C5WOhWXDBRJHTGJlvQyUIrF7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4456	2200	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 2200	3388	rundll32.exe	85
PID 3388 wrote to memory of 2200	3388	rundll32.exe	85
PID 3388 wrote to memory of 2200	3388	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-filesystem-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-filesystem-l1-1-0.dll,#1
  2⤵
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 600
    3⤵
    - Program crash
    PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2200 -ip 2200
1⤵
PID:936