da3910ac51cc5d01d7bab3da5b4e01fc17889656478e50c3b9c1557f59ca3b26

Analysis

max time kernel
141s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-06-2024 03:38

Target

da3910ac51cc5d01d7bab3da5b4e01fc17889656478e50c3b9c1557f59ca3b26.dll
Size

911KB
MD5

e2c1060e7c56a00888cd1221efdab197
SHA1

f3ae8d1feaef171f26538833251d3f3e68072db0
SHA256

da3910ac51cc5d01d7bab3da5b4e01fc17889656478e50c3b9c1557f59ca3b26
SHA512

de25a18c876a40f9a5787faf54e6a71360f806612f05b6c05632d87e8d14f9401d4bbbb6cec84c54831816bff10157b6547be0f2981d27b2e5159c3e29144156
SSDEEP

24576:AuxTZtiTj6k5FsR1wliVlcb4bZk61V+c4N/wWdu5UEV8y3GmTxL:h8W4FsrmiDcf61sc4N/pEVv3H9L

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3708	4248	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4248	2472	rundll32.exe	91
PID 2472 wrote to memory of 4248	2472	rundll32.exe	91
PID 2472 wrote to memory of 4248	2472	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da3910ac51cc5d01d7bab3da5b4e01fc17889656478e50c3b9c1557f59ca3b26.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da3910ac51cc5d01d7bab3da5b4e01fc17889656478e50c3b9c1557f59ca3b26.dll,#1
  2⤵
  PID:4248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 576
    3⤵
    - Program crash
    PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4248 -ip 4248
1⤵
PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:5968

memory/4248-0-0x0000000075370000-0x000000007547E000-memory.dmp

Filesize
1.1MB

Download
memory/4248-1-0x0000000077640000-0x0000000077855000-memory.dmp

Filesize
2.1MB

Download