bb6b7ebf49d7bb71b60768215b64e7883a8995dd9f145155f3f012874c226ae4

Analysis

max time kernel
135s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 15:53

Target

OfflineExplorerEnterprise/Offline Explorer Enterprise/mfile.dll
Size

140KB
MD5

5bb8d0e82e86c9109e6e65a5c292e6ed
SHA1

7892551993f8f1acee6b33e27b157af24dc5ab50
SHA256

62c0fbb7d57b37f41a962afa3273b03a3fa06d564e897422e9355f1e9d1393f7
SHA512

a1333f2080363f84e79aad7f20f1283a58f1283ea3b9779c2dd495e7b3617dc31b6d61bae3429a09695baf8578b8c57748026184111a7866450f37044dc615e2
SSDEEP

3072:AcUn1hDcNbheRYgw0K6Ag0FuHaQchKFE4:AcUn1hDOQYgwn6AO6

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3364 2796 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3364	2796	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3456 wrote to memory of 2796	3456	rundll32.exe	rundll32.exe
PID 3456 wrote to memory of 2796	3456	rundll32.exe	rundll32.exe
PID 3456 wrote to memory of 2796	3456	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\OfflineExplorerEnterprise\Offline Explorer Enterprise\mfile.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\OfflineExplorerEnterprise\Offline Explorer Enterprise\mfile.dll",#1
2⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 548
3⤵
- Program crash
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2796 -ip 2796
1⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3608,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:8
1⤵
PID:4100

memory/2796-0-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download