b61094c4d893c617d4884ca2da240da17fd2d92fe641fc1899d07d9d70539974

Analysis

max time kernel
138s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:36

Target

CoreUIComponents.dll
Size

2.0MB
MD5

28a9062f97909b3370df3f54b6705e10
SHA1

cf29a1bcaac54a9399f977955dba42158f8fb691
SHA256

b61094c4d893c617d4884ca2da240da17fd2d92fe641fc1899d07d9d70539974
SHA512

ff93ffa4db9d38c30f6dd1d1a5f578cdba4a8df411b032bb6657c89e66ade1d41972c1d6f49a8477791eb1f781d1ae2b258d79b8714144598288ebccdec48d35
SSDEEP

24576:fKUq+1fmOol6gCVr9eRPKPQsGDa52TfVeHXP8BZgSbDFbQpBA2HIzlJFTs:N1fmgIKPQKx2/deBA2IxJFw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
348	3292	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 3292	2476	rundll32.exe	83
PID 2476 wrote to memory of 3292	2476	rundll32.exe	83
PID 2476 wrote to memory of 3292	2476	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoreUIComponents.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoreUIComponents.dll,#1
  2⤵
  PID:3292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 648
    3⤵
    - Program crash
    PID:348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3292 -ip 3292
1⤵
PID:4552