82c94b997620c8570159ff4e9161709ad496bd35417cd37dc6bab14a2a7ef6d0

Analysis

max time kernel
132s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 18:29

Target
82c94b997620c8570159ff4e9161709ad496bd35417cd37dc6bab14a2a7ef6d0.dll
Size 176KB
Sample240603-w45tyafh79
SHA256 82c94b997620c8570159ff4e9161709ad496bd35417cd37dc6bab14a2a7ef6d0
MD5 2430d599761f75dd2f1e33552fd028de
SHA1 de495ea88cb4e98197cc101f5725bd651de4dd0e
SHA512 0e030ad6a45d1be614f1b2d2be684144339336cd007a5d86d90dd492d2984471c7d7b103ffacb2d301a8cb16f7c6d0f57dc7e5c7c1f67671661a0172d1ec0853
SSDEEP 3072:gCeFsgxkePhj4eRTbJLDAnWsCvV+3qdfvWLlTB6ZiNGxunySjfrjgCMp/d03e+IS:gpFsgxdhj4sArx0D4OpW3nH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1468	1768	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 1768	2740	rundll32.exe	90
PID 2740 wrote to memory of 1768	2740	rundll32.exe	90
PID 2740 wrote to memory of 1768	2740	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\82c94b997620c8570159ff4e9161709ad496bd35417cd37dc6bab14a2a7ef6d0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\82c94b997620c8570159ff4e9161709ad496bd35417cd37dc6bab14a2a7ef6d0.dll,#1
  2⤵
  PID:1768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 620
    3⤵
    - Program crash
    PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1768 -ip 1768
1⤵
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:8
1⤵
PID:4704