4fda471663f28d238af3e66a7ea99b1510a5ca4d36c12484ef4057c556f7f40d

Analysis

max time kernel
139s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 14:23

Target

resources/extraResources/boost_iostreams-vc90-mt-1_58.dll
Size

48KB
MD5

3c137fb13a39574125a40ad93c0ca73d
SHA1

625904713ac5e72839b41bcd96a3ef3fa727277c
SHA256

d21d1fae5ad6561855b2028f0babb19993cdd2e258e9ff01c40f9aafbf296d03
SHA512

f456de2d5a2c39133d042aea2832790606bd19ea4d6f8f9e2f68ef3301d316077a7d42cdd92811c9392325de536098bdc7f796c410b4d1e6b9e91a9520f5b624
SSDEEP

768:wmuYRe/bMAueOLlDtqkKSKfaOX+OttHDKA85YiDnpAMxkEarR:wmuYM/bMAueOLlDtQS0afOtZ27Dxx+rR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2228	3288	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 3288	3424	rundll32.exe	82
PID 3424 wrote to memory of 3288	3424	rundll32.exe	82
PID 3424 wrote to memory of 3288	3424	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\boost_iostreams-vc90-mt-1_58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\boost_iostreams-vc90-mt-1_58.dll,#1
  2⤵
  PID:3288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 604
    3⤵
    - Program crash
    PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3288 -ip 3288
1⤵
PID:2584