c426ca48a4011a9eca81732eb02f8ca3fbfd9ecbfb152f0be6346cf8f974cd74

Analysis

max time kernel
139s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 06:07

Target

GdiPlus.dll
Size

1.4MB
MD5

b0da5babd745e9d07da0b36e46c6ca8f
SHA1

f24df2514e7414db9ee0145e7d4382ea4afdd0a2
SHA256

c426ca48a4011a9eca81732eb02f8ca3fbfd9ecbfb152f0be6346cf8f974cd74
SHA512

4b03477f05bfed0bc943537cf6806f792f58ce5aa5ec32bf5db7868bad7fc1a882263af3c84cf34073a3f5ca2dde7c9b0bd21ca53f71672ad226d8673cb9fe81
SSDEEP

24576:VB8/fTbZCpcG+iR5wmlRnlAwTT1V11PS5q2c5RO211CymNtDM8aOMQTCf1ZId/YO:7eG5wmlbaE2c2MQTCf1WdJ84LhrdNrh9

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4408	228	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 228	64	rundll32.exe	83
PID 64 wrote to memory of 228	64	rundll32.exe	83
PID 64 wrote to memory of 228	64	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GdiPlus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\GdiPlus.dll,#1
  2⤵
  PID:228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 604
    3⤵
    - Program crash
    PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 228 -ip 228
1⤵
PID:2364