8921db60bc9ddd49d1455d73e455dc9a0c6045c1ebc5e618d2d4cdd4866ad0f8

Analysis

max time kernel
138s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 10:56

Target

8921db60bc9ddd49d1455d73e455dc9a0c6045c1ebc5e618d2d4cdd4866ad0f8.dll
Size

1.5MB
MD5

2b0efed936ff7ae6c504d7736f0d5211
SHA1

28647726fe3d658a85d6379e63779375badf2b5a
SHA256

8921db60bc9ddd49d1455d73e455dc9a0c6045c1ebc5e618d2d4cdd4866ad0f8
SHA512

59e5b3040e9312804b37837c1e6d426630118f9752f1c28c0b79713f24c773b3f94c76a21968e97d264a6fde22603b2c264d12280072964b2e42bb2b6668f637
SSDEEP

24576:ysdNntWdIcu9G89tC+wcgsqzku7RIMONwFAfMoCJHDZuZydA8gUgg8QD3jzP6Nyu:NdNntEIcuc8H/0sARIMOQAfdCJhdASTO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11128	864	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 864	4228	rundll32.exe	90
PID 4228 wrote to memory of 864	4228	rundll32.exe	90
PID 4228 wrote to memory of 864	4228	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8921db60bc9ddd49d1455d73e455dc9a0c6045c1ebc5e618d2d4cdd4866ad0f8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8921db60bc9ddd49d1455d73e455dc9a0c6045c1ebc5e618d2d4cdd4866ad0f8.dll,#1
  2⤵
  PID:864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 624
    3⤵
    - Program crash
    PID:11128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 864 -ip 864
1⤵
PID:11092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:8
1⤵
PID:7108

memory/864-0-0x0000000010000000-0x000000001021A000-memory.dmp

Filesize
2.1MB

Download
memory/864-1-0x00000000759C0000-0x0000000075BD5000-memory.dmp

Filesize
2.1MB

Download