ba067698a42552e1f975d0c5c57ba51623c4db634ba7830a7a90bc4a219a48eb

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 19:14

Target

Debug/api-ms-win-crt-private-l1-1-0.dll
Size

71KB
MD5

3d139f57ed79d2c788e422ca26950446
SHA1

788e4fb5d1f46b0f1802761d0ae3addb8611c238
SHA256

dc25a882ac454a0071e4815b0e939dc161ba73b5c207b84afd96203c343b99c7
SHA512

12ed9216f44aa5f245c707fe39aed08dc18ea675f5a707098f1a1da42b348a649846bc919fd318de7954ea9097c01f22be76a5d85d664ef030381e7759840765
SSDEEP

1536:g0DjXDe5c4bFE2Jy2cvxXWpD9d3334BkZnVPL9VG:XjDe5c4bFE2Jy2cvxXWpD9d3334BkZnI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3208 1680 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3208	1680	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4896 wrote to memory of 1680	4896	rundll32.exe	rundll32.exe
PID 4896 wrote to memory of 1680	4896	rundll32.exe	rundll32.exe
PID 4896 wrote to memory of 1680	4896	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\api-ms-win-crt-private-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\api-ms-win-crt-private-l1-1-0.dll,#1
  2⤵
  PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 600
    3⤵
    - Program crash
    PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1680 -ip 1680
1⤵
PID:64