65b8710598416e9045603ea83259a5536d8bf431689c2955c6986ac2ced62381

Analysis

max time kernel
139s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 18:38

Target

DLL/libhunspell.dll
Size

578KB
MD5

ac2478223d79e405fc1154e19c61f68f
SHA1

9f899dac2b2501aee4e03381eeca7df34a3b4c47
SHA256

4fdb1537458441ecfe4a323647091631a1c5cce92bba8bd51619637951f7cb31
SHA512

6938006994ed0bf210a2143907d741400cb4d1b8afcae101be1d45b5b5e37520fdfdd930a0ef5cbcf3b81f67e107974e294c4232821730f32ca9eaffd0856f56
SSDEEP

12288:q7O74ZjEMD44/ntRieNYRDGf12jntfUrf/JFAPsByypqSFe1co+:aO74jEMDRYRDG8p0JF3ByKqS4co+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	560	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 560	2376	rundll32.exe	90
PID 2376 wrote to memory of 560	2376	rundll32.exe	90
PID 2376 wrote to memory of 560	2376	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\libhunspell.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DLL\libhunspell.dll,#1
  2⤵
  PID:560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 600
    3⤵
    - Program crash
    PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 560 -ip 560
1⤵
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4276,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
1⤵
PID:2372