a14fa40b174aa50e6ca01dcf32a346c1eae8737eb6ed93a558cdeb601b86986b

Resubmissions

09/06/2024, 10:21

09/06/2024, 10:21

09/06/2024, 10:08

max time kernel
142s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 10:21

Target
Additional/CiWinCng32.dll
Size 2.6MB
Sample240609-md1b4aaa48
SHA256 ce67945c1f951d38aa65440fcb5145bc9bac340ac1b23ac2edb91ffd2c13536e
MD5 23bc06067a83155d329d330c3b018223
SHA1 f7fadcdc733d0b74706d270724a45c56e8486d6d
SHA512 16bb0c60dd139017494a78ec7cfeac23636c623dd30ae4a4350da463e88502e791ce55f7db17426df6248cffb1187eb261da275043a09aa992b27dadfb656f50
SSDEEP 49152:TmpDEkl6TwVeoZItytWBlz0tPsvOby8uvCDZGUfITVbBSd4:TmpDEg60UUoytWT0evOpxm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
844	3352	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 3352	2836	rundll32.exe	90
PID 2836 wrote to memory of 3352	2836	rundll32.exe	90
PID 2836 wrote to memory of 3352	2836	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Additional\CiWinCng32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Additional\CiWinCng32.dll,#1
  2⤵
  PID:3352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 632
    3⤵
    - Program crash
    PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3352 -ip 3352
1⤵
PID:1884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:2584