4fda471663f28d238af3e66a7ea99b1510a5ca4d36c12484ef4057c556f7f40d

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 14:23

Target

resources/extraResources/boost_program_options-vc90-mt-1_58.dll
Size

335KB
MD5

00ab4a4aa0dae3f28c1b794c6ae852ed
SHA1

ec1186fd1da950079a61db29aa7569961f39d8bc
SHA256

636d6e0d3f37f1b9bb8421098d803e371fb2cf27908503d5dcd61b9018eb4611
SHA512

cd5cd6fb647366a8b20eb2dfc2ca4cd8982e09c5a462e67f10541f5261fe6a013af409b7f7f8ee20c7931e6c1ca5d8a94bc8aa1b7e4b14ce872bb4279ebee56b
SSDEEP

3072:FafTjiIGCbi4Mp7d57LZevMCWzy3NRWjmhlxBjOyB5XbVGfjdW/B:gfT2IVbihLDD1mhXBjOyBR5Am

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	3152	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 3152	1448	rundll32.exe	82
PID 1448 wrote to memory of 3152	1448	rundll32.exe	82
PID 1448 wrote to memory of 3152	1448	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\boost_program_options-vc90-mt-1_58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\boost_program_options-vc90-mt-1_58.dll,#1
  2⤵
  PID:3152
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 604
    3⤵
    - Program crash
    PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3152 -ip 3152
1⤵
PID:4408