a3b5e0722576ace99b8537458bcae2147df09520caf11138a8a5e87c041b18c6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:51

Target

dot3ui.dll
Size

326KB
MD5

8fbe98499adc541c63bb10b722da00d4
SHA1

a558e7b61b27cfc20569bbc1ddc33a5e9f541cb8
SHA256

a3b5e0722576ace99b8537458bcae2147df09520caf11138a8a5e87c041b18c6
SHA512

a97813d6e3ae35f1dcde0f8fe99247ca9918a8a675059ea46720c50ff80a51ae759146a9c36aa2a16205472cda48af843ead99bddd6431dc79bc13620ce4e354
SSDEEP

6144:9aH7jRyRt7h5wHj0vzGNo+13i3YaO70avg24In4vIMc8oIACENB/QN6MS:cbjc7Tcj5o+1S3YaO70avg24InscDB/y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4448	4644	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4644	1416	rundll32.exe	83
PID 1416 wrote to memory of 4644	1416	rundll32.exe	83
PID 1416 wrote to memory of 4644	1416	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dot3ui.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dot3ui.dll,#1
  2⤵
  PID:4644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 616
    3⤵
    - Program crash
    PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4644 -ip 4644
1⤵
PID:4860