182ed66336253400a72f1a11ba34c14951fe236a06d89dff16eb6d791627549d

Analysis

max time kernel
1368s
max time network
1160s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 18:39

Target

resources/extra_resources/duolingo_english_test_helper/mscordaccore_x86_x86_4.700.21.31506.dll
Size

958KB
MD5

5aab0baebaf64b1aa0e2894da815fff1
SHA1

a4c758580664f98c288314b7414a7faf931ab90d
SHA256

38877f1ed46b426f636b6f4ca2463a16f193925975a3e296d910b819a850083b
SHA512

2fa97c44554a2a8585b97672e1749843cc88c80f9f467a835f73ef79c1ac85e73f8717569742c024b412460d6eae996f3349ee31d768ca4c556ceebdd08ceb40
SSDEEP

24576:asNvkhyIJUu6l//8uLFu4VCXC+PG9/jrxiXRNbZ5k6B4w:92hyIqT//8uLFuACSZ/jAnC6B4w

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4964	4292	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 4292	2924	rundll32.exe	84
PID 2924 wrote to memory of 4292	2924	rundll32.exe	84
PID 2924 wrote to memory of 4292	2924	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extra_resources\duolingo_english_test_helper\mscordaccore_x86_x86_4.700.21.31506.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extra_resources\duolingo_english_test_helper\mscordaccore_x86_x86_4.700.21.31506.dll,#1
  2⤵
  PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 624
    3⤵
    - Program crash
    PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4292 -ip 4292
1⤵
PID:5072