6baa51da775f898b0cd03372be44ea4aa4355ac31c473d92f718b189c2e7b3f5

Analysis

max time kernel
125s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 09:38

Target

x86/msvcr100d.dll
Size

1.4MB
MD5

b245bf00ba8c1196dbf8c2bd5dec9f60
SHA1

3090b2365ef1c3dbb378d309ee4b9aa811548e07
SHA256

80e8c0147f9960c8982092a4b43329835dc394036306bdd1a763bb59eb3d751b
SHA512

45b453c117fe3ae541eb9af0f8c7fff12dba4c83c95b6ab53027ba5650e44483738cbac34b2847b5830697c66d537dcbc54e76c0235ce7bfa3f9aacdfce685a3
SSDEEP

24576:7m/wTbJniLOB8QyruNelIQrTLGA1IZxvW6q9yNxsjcLO++yR6lPUoLpmLy4fAh:718QyruNwrXGAujvn84qcOvv

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3124	4176	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 4176	368	rundll32.exe	90
PID 368 wrote to memory of 4176	368	rundll32.exe	90
PID 368 wrote to memory of 4176	368	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\msvcr100d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\msvcr100d.dll,#1
  2⤵
  PID:4176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 600
    3⤵
    - Program crash
    PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4176 -ip 4176
1⤵
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4440,i,2651612535745483053,7868876458147986089,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:8
1⤵
PID:2224