72c018224ed1dfabeb9648b75aa38e1d539af0a578258943f75baea71deb45e4

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 02:22

Target

72c018224ed1dfabeb9648b75aa38e1d539af0a578258943f75baea71deb45e4.dll
Size

208KB
MD5

34694bac391a72ad99777a96da2ab884
SHA1

ffdf6a7d932527fa1885148ed8e40831f4ffc207
SHA256

72c018224ed1dfabeb9648b75aa38e1d539af0a578258943f75baea71deb45e4
SHA512

bca6ff1b89ffe004d0d3d7488f5a3ede47acacf446527b06d4a449388b29e110363685d0489a8bd8092a41bd7764c1483371adac1be786c8f816fe8db743d5e9
SSDEEP

3072:cI6CqRCxffkClZ8Ccn7LQlRw6x+Y3CxT2DtK5jdUJKY5H:cIDff9D8C6XYRw6MT2DEjK

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4896 4344 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4896	4344	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4844 wrote to memory of 4344	4844	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 4344	4844	rundll32.exe	rundll32.exe
PID 4844 wrote to memory of 4344	4844	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72c018224ed1dfabeb9648b75aa38e1d539af0a578258943f75baea71deb45e4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\72c018224ed1dfabeb9648b75aa38e1d539af0a578258943f75baea71deb45e4.dll,#1
2⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 632
3⤵
- Program crash
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4344 -ip 4344
1⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:1788