bb6b7ebf49d7bb71b60768215b64e7883a8995dd9f145155f3f012874c226ae4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 15:53

Target

OfflineExplorerEnterprise/Offline Explorer Enterprise/gdiplus.dll
Size

1.5MB
MD5

81246ebdc2139bad569503f10dbed1ab
SHA1

2f48937029647ea114c510e3337704ab5c995d6c
SHA256

0d0ca1dcacdeff34b62a299df13030aa0d5889576f971f990cab5c26c71fafc6
SHA512

b20f37c2a7ebab96b01f886a890cf0fb649e0d769e718060535ec4852739b08ceead7ba373f69f68b2015a5ac15ac37e928431c033b8089df815812cd9d33fec
SSDEEP

24576:0k18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z9lj:0ZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+Iy6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

524 1400 WerFault.exe rundll32.exe

pid	pid_target	process	target process
524	1400	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4040 wrote to memory of 1400	4040	rundll32.exe	rundll32.exe
PID 4040 wrote to memory of 1400	4040	rundll32.exe	rundll32.exe
PID 4040 wrote to memory of 1400	4040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\OfflineExplorerEnterprise\Offline Explorer Enterprise\gdiplus.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\OfflineExplorerEnterprise\Offline Explorer Enterprise\gdiplus.dll",#1
2⤵
PID:1400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 624
3⤵
- Program crash
PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1400 -ip 1400
1⤵
PID:1512

memory/1400-0-0x0000000070D00000-0x0000000070E94000-memory.dmp

Filesize
1.6MB

Download