1fc473958611f369cd79f6d35d96c8bd7ff5724b9980106b3284c917da17d674

Analysis

max time kernel
140s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 04:15

Target

libReportParam2.dll
Size

855KB
MD5

8043f79e49a7781023a8a647df4c5285
SHA1

b20498dbca54143cc342202e3049c505031d966b
SHA256

7fa943df288d7ae2b9946462ce6c17b895a1f11b1350545efe420178a22a968e
SHA512

584b547ad56fab1a782d76807ec5b1f629f64b2ed6011580cbd787d2e555dcb02eafda985e9246c9b7e6e3fd8628b1299e91b1a613d9ae7001356090dc1ec554
SSDEEP

12288:WOq97/78eFYato0rcLHE6UdQyUnzyrbD52Qfl7U5oCDI75RyYauT6i/syj63n6:W38uYat3czE3u2/5jfl7C9AzauOii

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	5108	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 5108	3684	rundll32.exe	85
PID 3684 wrote to memory of 5108	3684	rundll32.exe	85
PID 3684 wrote to memory of 5108	3684	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libReportParam2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\libReportParam2.dll,#1
  2⤵
  PID:5108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 696
    3⤵
    - Program crash
    PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5108 -ip 5108
1⤵
PID:928