ba067698a42552e1f975d0c5c57ba51623c4db634ba7830a7a90bc4a219a48eb

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 19:14

Target

Debug/ipcclientcerts.dll
Size

184KB
MD5

09fbcc65bc9ea19ad51aff161900a97f
SHA1

7951dfe9b7226509c54adb98bf64869c2a164027
SHA256

d050654b9fd3d655b7b9d9c0a0a3ec43a2213bd71762a56aafbcb184b591ce32
SHA512

58ffd5741c887f6bb0602e847019bc4c51e80c2dd16ce68bef91ab648bf967b4f65cc84cc4c5d921635145b456edf85886f7685f0685f331a227e006ed2cf70c
SSDEEP

3072:ZbyyGbu6wHdyZcOMf5SZ53pKT4hd4YyOMVew2yivJvFFnlvWRCJEGBnz2Otp1ziC:ZbZAu6UdyZcOMm3wT4oKyWFnlsCJEGFh

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3988 2232 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3988	2232	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4848 wrote to memory of 2232	4848	rundll32.exe	rundll32.exe
PID 4848 wrote to memory of 2232	4848	rundll32.exe	rundll32.exe
PID 4848 wrote to memory of 2232	4848	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\ipcclientcerts.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Debug\ipcclientcerts.dll,#1
  2⤵
  PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 604
    3⤵
    - Program crash
    PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2232 -ip 2232
1⤵
PID:452