0ab29a1c5c76e79998b45ddc32e3377d3f59bcd99a0f67f3e831ad02996c96b8

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 18:38

Target

$TEMP/diaeresis.dll
Size

10KB
MD5

51921a259471561b82e7b37b08cac3a5
SHA1

a3d991d42e1861f4db64438969116771bc8dbb81
SHA256

32dc82dd46ca4e4937b9f3c31988dde9cd1cfd4c907798d942b13394169f1bf6
SHA512

2446084e48688f37e60116c734dc9c8172e3692b2dde6e915c35f89bed7c383c4c62516680b4a701f3a8d29bcfdf7418f9846c302d4a64f042aabe000b07aa7a
SSDEEP

192:dWRKKJtAvnh/W+z0DPlZ8GRSkmBxu22HypO00XX:dwJtAf70pRgxdJO00XX

Score

4^/10

Drops file in Windows directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\win.ini rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5788 4036 WerFault.exe rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	rundll32.exe

pid	pid_target	process	target process
5788	4036	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3828 wrote to memory of 4036	3828	rundll32.exe	rundll32.exe
PID 3828 wrote to memory of 4036	3828	rundll32.exe	rundll32.exe
PID 3828 wrote to memory of 4036	3828	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\diaeresis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3828

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\diaeresis.dll,#1
2⤵
- Drops file in Windows directory
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 576
3⤵
- Program crash
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4036 -ip 4036
1⤵
PID:5808

C:\Windows\win.ini
Filesize
131B

MD5
9848e4efb0abd437d65e6d3d1d973adb

SHA1
f427ac7c50b19f66658ae7f92cbaf21110b49a47

SHA256
c8b84add37da849977a84fe62badb6cb908be99769edb70d60bcd04c0aec2a3f

SHA512
f90f1f65b6b824a526469b8d739f733a54a7f485d8b5f680de7a35fac90786bf6ba5a0b1d62e139663c5ee73b8d687cf32d4ccf188e18c53084ec12d8c216b17

Download Submit
memory/4036-0-0x0000000000B60000-0x0000000000B67000-memory.dmp

Filesize
28KB

Download
memory/4036-8-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/4036-9-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download