d43d793529aa53d452cc85badf97e5aa04fe09f61d99046c655a51b31709b624

Analysis

max time kernel
137s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:20

Target

GenericWindowsUtils.dll
Size

11KB
MD5

896edf2c096265549fd8bb9ee23efc2c
SHA1

3c7a1dbb68afaeff2f132ca738d5cf2818b8ab13
SHA256

a3a03e816a12db0e7e4288eb00c3426a71ca7b402f623c77ad7b7f84e82b64ec
SHA512

3149931140eb9fed0d28528ce048250392897ac61f890d176ac45a4c5464b9744cebc0c0f0b69945f742835612211c059d7ebb29f8d779e0bb99cd2d8cbea56b
SSDEEP

96:9LQL4h4LJnwSpkCY3QaTVfHdVL8J8+B5o0K+3+X3+H+b+z+T+1Judcu5u+VK+/+i:5QEAZX+CY33vLkdakrSQOV+SLWNg

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3552 4732 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3552	4732	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5048 wrote to memory of 4732	5048	rundll32.exe	rundll32.exe
PID 5048 wrote to memory of 4732	5048	rundll32.exe	rundll32.exe
PID 5048 wrote to memory of 4732	5048	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GenericWindowsUtils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GenericWindowsUtils.dll,#1
2⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 600
3⤵
- Program crash
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4732 -ip 4732
1⤵
PID:1384

memory/4732-0-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download