83a77107f029daadc4130a3fb086eb860969d86817f17ccbef12e9287052f2d4

Analysis

max time kernel
95s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 06:19

Target

cactivex.dll
Size

1.9MB
MD5

3acfceea53927189725b30344c811ef8
SHA1

ee2c35adbc433e30636bad701b0180b92cd1087f
SHA256

1fb1fb2e07331ad830833648d39d9b741a617e3391974f93f7655070c1961bcf
SHA512

34bd88babf04af9136b34fb162aa3a80b4c11ca0583512cb6dfbd1b0e0f351b0f0d7df9a6208b16b2c439e2332dd490257f4d3ed5bf295f72b5f53c73b1d08dc
SSDEEP

49152:wJEi4e11aFokYjUONrMdDe27x584E+CrAcGlwGEia8bCvfZJXWINcfCXHjk:qazYjJNAdDe27X84E+CrAhlwJS4fZJXA

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2980	3452	WerFault.exe	81
1904	3452	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3452	2988	rundll32.exe	81
PID 2988 wrote to memory of 3452	2988	rundll32.exe	81
PID 2988 wrote to memory of 3452	2988	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cactivex.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cactivex.dll,#1
  2⤵
  PID:3452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 708
    3⤵
    - Program crash
    PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 708
    3⤵
    - Program crash
    PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3452 -ip 3452
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3452 -ip 3452
1⤵
PID:3716