7e10398905caf94288d9225b088dbc009c868c9331bc1dc9392509ced4a24abb

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:49

Target

enterpriseresourcemanager.dll
Size

83KB
MD5

8fc77f53d9bc6cbbf1234ae680a1b31d
SHA1

91cb0afb5483a4996752575097a05113c7d82637
SHA256

7e10398905caf94288d9225b088dbc009c868c9331bc1dc9392509ced4a24abb
SHA512

8251fc12b4dda5210f2e67f5b099f29f0cb8803fa35a834d7eea10bfdd210be3c4b7b53a2aac2fd87713089e1eefd1c155d88ee731c0afa7fee96834d779370d
SSDEEP

1536:F+GTUP8Ssx+ZXCzEcPXi6o3dLm2YJPjBL9J99lXO15B5C7lc:FT08SK+wBPXi6o3dABLN9leh5yW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	4504	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4504	5068	rundll32.exe	84
PID 5068 wrote to memory of 4504	5068	rundll32.exe	84
PID 5068 wrote to memory of 4504	5068	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\enterpriseresourcemanager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\enterpriseresourcemanager.dll,#1
  2⤵
  PID:4504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 648
    3⤵
    - Program crash
    PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4504 -ip 4504
1⤵
PID:4824