23a66b32dfa75a94036870a1dce0bfabe6b52331eb2bed02e6953b9fead97298

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 11:53

Target

hostfxr.dll
Size

309KB
MD5

0827a73b3e611d14b04aea7afa7bb916
SHA1

f7edaaf2afa6f6807c9880ba8bfa0ecd6bc792c4
SHA256

ec76e4e93532e235e219fc02b7b9bb13512c06ae294c83de31ca8a72edcab295
SHA512

b986d26db2d261509b8de9f626863753ea6996655349450d4df144e8d406438a78b61fabf2e603d86d7f73256fb7768272a0cf13c857e785c2cb703e06439f33
SSDEEP

6144:bAsUSrJf6QPAL8Rcq9nJ/LVF2vmQjIOPES6Y7vxc593Z+/rv7biucmv+yh:bbUyJyQPALicq9nJ/LVF2/IOP9xkl0/N

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2764	4832	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4832	2512	rundll32.exe	86
PID 2512 wrote to memory of 4832	2512	rundll32.exe	86
PID 2512 wrote to memory of 4832	2512	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\hostfxr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\hostfxr.dll,#1
  2⤵
  PID:4832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 612
    3⤵
    - Program crash
    PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4832 -ip 4832
1⤵
PID:4852