399dabda644d6aa4cffcc303850fe5f871d960224e442fb355d37d7b84c6d227

Analysis

max time kernel
139s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:35

Target

399dabda644d6aa4cffcc303850fe5f871d960224e442fb355d37d7b84c6d227.dll
Size

8KB
MD5

3623c3b3a037e2896be9c94da4017899
SHA1

419b2883c120473c3bb016a7ec630756ac481575
SHA256

399dabda644d6aa4cffcc303850fe5f871d960224e442fb355d37d7b84c6d227
SHA512

c40b16afdf34dea1a886f6c7e62dfa7df89228f1ba120010e5d5601032267489a113bed06d110282cd873843fab707711dfdcfc9cd95e0ba86e4ddbdc09c84ad
SSDEEP

192:rLxQpVUv5fK54GRtQN6f0CZz+wEZ8OZzv82yRDmWsGKJcp9VYY:rGVUZK54+ff0Cgwe9vclm0XVY

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4628 3488 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4628	3488	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4756 wrote to memory of 3488	4756	rundll32.exe	rundll32.exe
PID 4756 wrote to memory of 3488	4756	rundll32.exe	rundll32.exe
PID 4756 wrote to memory of 3488	4756	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\399dabda644d6aa4cffcc303850fe5f871d960224e442fb355d37d7b84c6d227.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4756

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\399dabda644d6aa4cffcc303850fe5f871d960224e442fb355d37d7b84c6d227.dll,#1
2⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 540
3⤵
- Program crash
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3488 -ip 3488
1⤵
PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1624