3c93d8b1e69fab840a52746dc183e2bcac113cf1f05bd558a689c0bb5f24f4aa

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 14:51

Target

CADe_SIMU V4.2/libnodave.dll
Size

124KB
MD5

3f9383240796ff0bcd7211aaffa70ec2
SHA1

29cb7113a6a08eaa701fd5d55811205d0d8499a9
SHA256

d61b4728dc1bdfbfcee780b2eecc867549ff4637bc611ba115e023d4bda493b6
SHA512

3e8eef1fa22858e40c1b97106dcf904f36aa271002e45b3b57bd1370753f413c14369e55f8e341ed09dcfd41a2cb5cbafef5021703ed2b5ae0b2f7e778ecc698
SSDEEP

1536:tyrhe5iAd5jGErfo0KtauWnuH3rXA4hBmILCC7dulTm0Dyw8jy1:tyo1NGErfOBYuHzpBXeC0lTm0gy1

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2004	3016	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 3016	3880	rundll32.exe	91
PID 3880 wrote to memory of 3016	3880	rundll32.exe	91
PID 3880 wrote to memory of 3016	3880	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CADe_SIMU V4.2\libnodave.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\CADe_SIMU V4.2\libnodave.dll",#1
  2⤵
  PID:3016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 612
    3⤵
    - Program crash
    PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3016 -ip 3016
1⤵
PID:3124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:8
1⤵
PID:1720