1e3fcd966e2d0b63e5a89dc82788da8225c85926dfdfd16c6712aea5b6a0ab28

Analysis

max time kernel
132s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:39

Target
SearchCommon.dll
Size 200KB
Sample240529-mqe7pace72
SHA256 38d90eba406c9148ebd7585820caff53e1c39e62a2e989937ce2efe67661b14b
MD5 17d1070d5ce79f3802a7baab2694f8d8
SHA1 2f64823daccd1e6f8b51ec9ff04652eaee13f976
SHA512 997e412f891d134f1826b9c9ba5d4233f4c89da0ca5ebd1cb9a5484e9eba374336ab8783d4610c75d9346c61d7f5d305b7619b1e5f651aa298348f4e707f9e84
SSDEEP 3072:DIPBhOo4PbOIXA0HRlxrl8NaPwb9dv+fLJaAY7eL8LLSz2xr830I:spso4PyIXzENaPw5doL8AYqL8LLKwa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3732	400	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 400	4576	rundll32.exe	82
PID 4576 wrote to memory of 400	4576	rundll32.exe	82
PID 4576 wrote to memory of 400	4576	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SearchCommon.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SearchCommon.dll,#1
  2⤵
  PID:400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 632
    3⤵
    - Program crash
    PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 400 -ip 400
1⤵
PID:4136