23a66b32dfa75a94036870a1dce0bfabe6b52331eb2bed02e6953b9fead97298

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 11:53

Target

clrgc.dll
Size

419KB
MD5

83561ada2482b088a381e8cbb94a3c03
SHA1

e58d58dd3191541d449a41d8e7c9d40ae55bf519
SHA256

acd770e53d74ccbc8b2e298b4991735583ecdf1827f42d5f29664e01c0000160
SHA512

0dff4e4585f5a98046581a457f23bdcb4d91ee190344a3146746299b6f538344adb7d5b7052c0d4ac8acc8efe9d37f4c90f1511db6de8bc5c2629ca4cbabb92e
SSDEEP

6144:Ve+1tRk4BTkADXyMczeMxWNhHI8mbb7RfXcFkZ6CdaOyycTYLqmdJb9oMK9+n+la:xR+ALycMxWHInZXcFkZ6YcTO9SWe+Y8

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1500	2992	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 2992	388	rundll32.exe	83
PID 388 wrote to memory of 2992	388	rundll32.exe	83
PID 388 wrote to memory of 2992	388	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\clrgc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\clrgc.dll,#1
  2⤵
  PID:2992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 616
    3⤵
    - Program crash
    PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2992 -ip 2992
1⤵
PID:4864