0d13dd9df82ec9d8b778815ae9634d8ab63a1facd76de25d406e33aa44b0aecf

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 12:54

Target
ExceptCatch.dll
Size 103KB
Sample240601-p5e7cade87
SHA256 40d5ef8e438cbdf01faefc6c9bf913ecce533c102740716555c9a5bfe9657e8b
MD5 c17ef9c194597572096713da10540c73
SHA1 8e5b85765aa91305aea5e236fb402be0460050b1
SHA512 83b952d917e79736edce2dbf00b2deafb8ef0f8f7dc67e5bf4e8993eca0186b538cad61f01758bf722b231efa39c68ad6a6e0c31bba7849b833e6efd9e3d2c21
SSDEEP 1536:j9lx/wlFp+65eZD97Ddlaiwl3+Ry8vQlXfp+5tOguwgMuk0gV1:Px/Wn5I7DPaiw3jlXU5tOguwgMp0gD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1512	4360	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4360	4948	rundll32.exe	82
PID 4948 wrote to memory of 4360	4948	rundll32.exe	82
PID 4948 wrote to memory of 4360	4948	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExceptCatch.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExceptCatch.dll,#1
  2⤵
  PID:4360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 892
    3⤵
    - Program crash
    PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4360 -ip 4360
1⤵
PID:2312