6ae8fc4a47782efb68c435abfe29c1962e6b6273e6d3f289dce7ecdf84017809

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 09:36

Target

6ae8fc4a47782efb68c435abfe29c1962e6b6273e6d3f289dce7ecdf84017809.dll
Size

2.0MB
MD5

9553923ac77dd68b7d94b57a1ccb829f
SHA1

8a4f3877977ed9b9abc98e31a29d89e896ae3dc1
SHA256

6ae8fc4a47782efb68c435abfe29c1962e6b6273e6d3f289dce7ecdf84017809
SHA512

cc8eeaea1f7f16cf586d0480e506951de807f3949eb92a915e27935c02ef09755b98ba155ae71e38866e3e4f9670ddc1b83ac368bfce7bff6c2c47b3ef145458
SSDEEP

49152:SpW2WCN9mIFOKjQ5TwkonUr1q7NWcPjH3hPbC5GMhE:SpW2WCDmIFOh5Tw+q7NWsXh

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2072	4440	WerFault.exe	91
3700	4440	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 4440	3484	rundll32.exe	91
PID 3484 wrote to memory of 4440	3484	rundll32.exe	91
PID 3484 wrote to memory of 4440	3484	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ae8fc4a47782efb68c435abfe29c1962e6b6273e6d3f289dce7ecdf84017809.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ae8fc4a47782efb68c435abfe29c1962e6b6273e6d3f289dce7ecdf84017809.dll,#1
  2⤵
  PID:4440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 620
    3⤵
    - Program crash
    PID:2072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 792
    3⤵
    - Program crash
    PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4440 -ip 4440
1⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4440 -ip 4440
1⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:1132