da3931ca3f57e8e7957563ac53a8e103a05ff7b6b4040fc0f24fa773c7884298

Analysis

max time kernel
132s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 08:07

Target

da3931ca3f57e8e7957563ac53a8e103a05ff7b6b4040fc0f24fa773c7884298.dll
Size

2.5MB
MD5

f801d7618810a7c802dd378ab181d4f3
SHA1

a2a0b087bfe6218658c8258e61a931a2a4c14c92
SHA256

da3931ca3f57e8e7957563ac53a8e103a05ff7b6b4040fc0f24fa773c7884298
SHA512

35b8b80073db5d3f1c207a538faaa27937aa031465f20c2ed09b0bfe6b6c94a52ea20d95223f257b545cf8346610236459ae9f7ecda0b76b8b39b456f73defad
SSDEEP

49152:4usshzeuN5dSNKt5rnZ+Bv/53gnRTRKP/rr45CKAREtT:LLle6Si5rnZ+F/Evgrr45

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	5036	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4628	5036	WerFault.exe	93

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 5036	2132	rundll32.exe	93
PID 2132 wrote to memory of 5036	2132	rundll32.exe	93
PID 2132 wrote to memory of 5036	2132	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da3931ca3f57e8e7957563ac53a8e103a05ff7b6b4040fc0f24fa773c7884298.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da3931ca3f57e8e7957563ac53a8e103a05ff7b6b4040fc0f24fa773c7884298.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:5036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 756
    3⤵
    - Program crash
    PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5036 -ip 5036
1⤵
PID:112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
1⤵
PID:4660

memory/5036-0-0x000000006D5F0000-0x000000006D600000-memory.dmp

Filesize
64KB

Download
memory/5036-1-0x000000006D5F0000-0x000000006D600000-memory.dmp

Filesize
64KB

Download
memory/5036-2-0x0000000074870000-0x0000000074AF7000-memory.dmp

Filesize
2.5MB

Download