c5a44b3d265b10212fe02cc581453d1fe751d30091282e1e2217c73ab196a232

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 15:00

Target

api-ms-win-crt-private-l1-1-0.dll
Size

71KB
MD5

11829527713fa070ed81f9a4c4a4c03c
SHA1

40a8f3c3d1770730ba26a44d21323e7bccd82ec1
SHA256

f794208a1b2e7ef1055d68dc8f6d4a960c7a95dc98685f886f03af7d0b57cec2
SHA512

e0b622f6da8551a22d80250cdf880452288f7757e6dfd4a281cf1f09b6199b7cb47018cb847be0a3843074c35915c8f9db4fd356317e84b2dbd3088c60dc4aaf
SSDEEP

1536:W0DjXDe5c4bFE2Jy2cvxXWpD9d3334BkZnVPLGBbeE2CDp:5jDe5c4bFE2Jy2cvxXWpD9d3334BkZnC

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3536	2256	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1680 wrote to memory of 2256	1680	rundll32.exe	84
PID 1680 wrote to memory of 2256	1680	rundll32.exe	84
PID 1680 wrote to memory of 2256	1680	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-private-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-private-l1-1-0.dll,#1
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 604
    3⤵
    - Program crash
    PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2256 -ip 2256
1⤵
PID:1380