1743c09774c8aa85ea6463bf48def681e4ccf13660620e7378ecd9df6c33169b

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 16:37

Target

Fish-v327-0221/pdflib.dll
Size

3.0MB
MD5

16388e5ef07daf3c4e5349ec150d89e8
SHA1

17b067db358bbb3c9a8abd147f4022e5f7c675c5
SHA256

e8bfcb004671292bff487e9d7fc418c247cf94193c03ec01e41bbc485aea0f22
SHA512

c9fe68fc6ee2968d6da4a1a879e7e0609506dbf2e3e1417d015cac47215dbcf2b1a5dd1299c609aabc2c4a509494cbef552b4edb8327e19277b259d89cf4458b
SSDEEP

49152:UpD7JBpjcpJ/hZ1WphyWy2zccqgPTF97irQE0kUjzDTjzDTjzDqEixp9Q5ht7/Xp:UpD7JBpjeJ/ahw2KgBKputKQ6/i

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1544	644	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 644	1456	rundll32.exe	83
PID 1456 wrote to memory of 644	1456	rundll32.exe	83
PID 1456 wrote to memory of 644	1456	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fish-v327-0221\pdflib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Fish-v327-0221\pdflib.dll,#1
  2⤵
  PID:644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 612
    3⤵
    - Program crash
    PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 644 -ip 644
1⤵
PID:4896