f49e600f0f138ede876c1e101c12cc8eabcdfd2a0ecc59ee4cce8d85a2b37f21

Analysis

max time kernel
131s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 11:53

Target

DictationManager.dll
Size

211KB
MD5

b967b79ea7d7eebcda53b307fdfb4ddc
SHA1

7f9d543a1f2d1a03005a303a79c73ae958b070a6
SHA256

f49e600f0f138ede876c1e101c12cc8eabcdfd2a0ecc59ee4cce8d85a2b37f21
SHA512

5b8936b8274c952a6bcc3f8977f0a1af7a4ceec6919f736ab75a667905d0b36ef9bcf34da9cc0efdbcf0ada88f2ea987a66dfed3cbd8fff37982aa24cb78f0ba
SSDEEP

3072:pQ4HnCz0SUasiDsaxQBsDtm8qKgk1+4k4L4/lbrZoITsPRxwYM+iD6Ngv097iD:G4iASUassqKgk1+eklHu41+7e

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1928	3392	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 3392	2604	rundll32.exe	83
PID 2604 wrote to memory of 3392	2604	rundll32.exe	83
PID 2604 wrote to memory of 3392	2604	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DictationManager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DictationManager.dll,#1
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 688
    3⤵
    - Program crash
    PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3392 -ip 3392
1⤵
PID:2140