4fda471663f28d238af3e66a7ea99b1510a5ca4d36c12484ef4057c556f7f40d

Analysis

max time kernel
88s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 14:23

Target

resources/extraResources/boost_regex-vc90-mt-1_58.dll
Size

712KB
MD5

3a8c0dce96d6a6da853428ace9de64df
SHA1

85f3671793ffdd7232ccda9e41d3d19b0f8d9255
SHA256

c831338c2c76d1a2dea8b65dd299ee65c8c15bf98338d03b502d87894b7546bc
SHA512

745f2e04d92c437a8930d6fc989b7062467064cb16ea39abcbd49f54d9ae452d6c9405c63cec3da8c785d00bb524336708f96ba69a16d1623428e847306e7204
SSDEEP

12288:DgR5mt76tAbSaR9lpurfWRkcmvWEXKNPu5CA+bzJji30XQV2bDFfaJWMBszyaJ+S:MmV6abSaR9lpurGmnb+XJji30AVeYWMQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3104	4876	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 4876	900	rundll32.exe	82
PID 900 wrote to memory of 4876	900	rundll32.exe	82
PID 900 wrote to memory of 4876	900	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\boost_regex-vc90-mt-1_58.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\extraResources\boost_regex-vc90-mt-1_58.dll,#1
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 604
    3⤵
    - Program crash
    PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4876 -ip 4876
1⤵
PID:2704