f4665a7274e113691256ab2e8d894098a5861558492ad71ee76544d029a172c1

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:54

Target

MCL_FPTZ.dll
Size

131KB
MD5

845ad8f36ee751315e148ccb4ffad4b7
SHA1

6e0ffd681541db282dfff684a2d4a6657b6b2567
SHA256

ab8434c64eedeb34994617d113fffae7b2f28b16be387488e2168a7fa64222c2
SHA512

290f022a2924f5db1b383f2313bd1d681b514d30ee4832c2eb9eb04febfc36e26bdad6f3429c3ef25810ddb5376daac174d3f9b594b53e946147827ba2658ac0
SSDEEP

1536:bIW4gFXt7zL4INElaQv+1eIARg+FjOcOjuWXfnywRxOPsGMBNSnt7QukRPcw4i:9l4INEyengJCCh3jBNStX0cw4i

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4628 5092 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4628	5092	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1620 wrote to memory of 5092	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 5092	1620	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 5092	1620	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCL_FPTZ.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCL_FPTZ.dll,#1
2⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 600
3⤵
- Program crash
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5092 -ip 5092
1⤵
PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1856