08f43236ad8cda9afc551ee334eee3ee0fad76e9f6a1bf9b61727ef6703114c9

Analysis

max time kernel
13s
max time network
16s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:04

Target
version.dll
Size 2.4MB
Sample240613-l36dzatfre
SHA256 08f43236ad8cda9afc551ee334eee3ee0fad76e9f6a1bf9b61727ef6703114c9
MD5 d78169f08bb3057d13ea8aa8a3e7bdd3
SHA1 6151e1f64bbd2c22e93b77d61f76e803936209ee
SHA512 144103cef39f43065a94d7554c70936e18a60c03fa843b0b07f7d278fc36fbf298cc054d1095a5ef826dc0f21be1eb4afd3b1aaf09a3c6430148d18a7aacfa5b
SSDEEP 49152:3/5thEDN+kSnUS75I/Z+xU6f7tBAtHfIR7dLSfDwP3HS3pOR/6n8EzjTDzqjmm:RL4EjAtHAR7Q30
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	4628	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4628	4044	rundll32.exe	89
PID 4044 wrote to memory of 4628	4044	rundll32.exe	89
PID 4044 wrote to memory of 4628	4044	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
  2⤵
  PID:4628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 624
    3⤵
    - Program crash
    PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4628 -ip 4628
1⤵
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4180,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:4504