301caf9b1c6aa0f71638c83bed495e38ac021fe468095ec487271e3cd5284101

Analysis

max time kernel
1474s
max time network
1495s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
23-05-2024 00:17

Target

rrrr/STRESS TEST/TestMem5 v0.12 (Many configs repackaged)/bin/MT0.dll
Size

12KB
MD5

47f6806d74205f0ece372d96d0634ea3
SHA1

21c3a60a648615317421be93432697253a3c7ff3
SHA256

3ee244962c2683022c3bcc78d1a869e755516bbf4d2c1123a8a55e47655731ef
SHA512

bc9803bf96682d587c3c64d9f787eb6567c5bb238c84c04e31d2729e125a8ebb61afe9f8af05dcff4f5af139f0dc6c2bffb4ca16e65476563aeca92c744bbd61
SSDEEP

192:qLT8KgmRoz3BP4nhf2gfI82Wqs9SrAiPZhKgwTYHQ7:qP8Kh2zK2MkrPPZhKgSf

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1988 1716 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1988	1716	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 480 wrote to memory of 1716	480	rundll32.exe	rundll32.exe
PID 480 wrote to memory of 1716	480	rundll32.exe	rundll32.exe
PID 480 wrote to memory of 1716	480	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\TestMem5 v0.12 (Many configs repackaged)\bin\MT0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:480

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\rrrr\STRESS TEST\TestMem5 v0.12 (Many configs repackaged)\bin\MT0.dll",#1
2⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 484
3⤵
- Program crash
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1716 -ip 1716
1⤵
PID:4384