148f10ab7d09aad597800b12f1ddf3965f4d693c092771554aa286b63a32d3c0

Analysis

max time kernel
142s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 09:20

Target

$_2_/ReportRecordDll.dll
Size

102KB
MD5

5dce71be1d5c14c42467d5f42d04ac92
SHA1

64d85f4b8182e88e11fb95256652b2eac69b84a3
SHA256

7e41e807976a6501e23acb86cecc7aecc3e6318116a9189f31bb17e6f6b59641
SHA512

4b3a202e8a1ed2cc87ff4a13a113b7adca8d9905bd10fb8c4aaaf818dcb36533dc416d1835709929d401c6da1d6d8ad20c4f2bd6dd51c2089cf81de785084e0a
SSDEEP

1536:WrBBEb0AnnTbvGP4wQz4a3fIpajT1m8IIl93kc8ZIfgzg5nO34OTl:Wb6nXvGP4wQz4XAX1mUfaglO340l

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1796	2404	WerFault.exe	90
2528	2404	WerFault.exe	90

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2404	2548	rundll32.exe	90
PID 2548 wrote to memory of 2404	2548	rundll32.exe	90
PID 2548 wrote to memory of 2404	2548	rundll32.exe	90
PID 2404 wrote to memory of 1796	2404	rundll32.exe	95
PID 2404 wrote to memory of 1796	2404	rundll32.exe	95
PID 2404 wrote to memory of 1796	2404	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\ReportRecordDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_2_\ReportRecordDll.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 716
    3⤵
    - Program crash
    PID:1796
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 716
    3⤵
    - Program crash
    PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2404 -ip 2404
1⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:2336

memory/2404-0-0x0000000000D80000-0x0000000000D93000-memory.dmp

Filesize
76KB

Download
memory/2404-4-0x00000000027D0000-0x00000000028FF000-memory.dmp

Filesize
1.2MB

Download
memory/2404-2-0x0000000000E30000-0x0000000000E50000-memory.dmp

Filesize
128KB

Download
memory/2404-6-0x0000000000E70000-0x0000000000EDA000-memory.dmp

Filesize
424KB

Download