cdd9213c986f4dcc1f2c07f584d564c6a3ba00c9c27fe016bf51fd70ff0ef973

Analysis

max time kernel
219s
max time network
318s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 23:01

Target

api-ms-win-crt-private-l1-1-0.dll
Size

62KB
MD5

682bf6b9c07a64929a4484db51d6c13d
SHA1

07672ce8f08db3b1d745b71e9db3e4729c70793c
SHA256

bdd0cca431ee362bed4f2c1eccafb22aa8dd51d57014be8297789175e5c11f2e
SHA512

e4ae0fc24114a58baede8443cb9275811c12a321ac898cda89efbd07474b8e60a564c55bbd82e37f521bf46b05fc1ca876f9b33f6d4bbbaed9fe0f03c937fce1
SSDEEP

1536:KaYDe5c4bFAcvxXWpDid3334BkZnGPMwPn7+9:6De5c4bFAcvxXWpDid3334BkZnGPMwP2

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4768	1200	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1200	2180	rundll32.exe	91
PID 2180 wrote to memory of 1200	2180	rundll32.exe	91
PID 2180 wrote to memory of 1200	2180	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-private-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-private-l1-1-0.dll,#1
  2⤵
  PID:1200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 600
    3⤵
    - Program crash
    PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1200 -ip 1200
1⤵
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3592