a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56

Analysis

max time kernel
41s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 08:22

Target

CoralUpdate.dll
Size

352KB
MD5

7b1938124b07781bea91fae264e99f87
SHA1

39ff40d2b9d1e5f51a2d9817d801c4242d21763e
SHA256

281bd67d445ccc728f5a92fb8200e306cd8d4d311a6a9edcb8c9760cf9d1ea93
SHA512

6bee84c135c60496eb79b272afbb5881cc3c1ac82bcf370b40209b5532d3922fec7be4b5af05044ef644146cda7d0baa32f344b86a40f1c27d416bb758c743bd
SSDEEP

6144:NiQRHSkgCAoHD/LDtwd3Zp5VsjInbJC65iRnGik0MPAcTHe1OjDxW6aOgoftcl:BZAoj/L2d31QoiRnGilcTHYOPJ0l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2160	2736	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2736	4836	rundll32.exe	81
PID 4836 wrote to memory of 2736	4836	rundll32.exe	81
PID 4836 wrote to memory of 2736	4836	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralUpdate.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralUpdate.dll,#1
  2⤵
  PID:2736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 640
    3⤵
    - Program crash
    PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2736 -ip 2736
1⤵
PID:404