8be410717226b5e873c61a30d92a767c6c6492ce6358cd79b2a41cb23dba05cd

Analysis

max time kernel
93s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 09:31

Target

PersonMgrV108A/GetIDESN.dll
Size

24KB
MD5

12d1d37c9f8f178b4fb0e93896343449
SHA1

9e086495bf2fa61440c97e2ba6bf69d4c93e0aab
SHA256

0e1cd361eec1462681da97a14a23bdc9280092d4fa4ad3cf42593c23c21c5e65
SHA512

fe2fe83c39c30c58302cc75a22912db04384bb2723cb135e5cb64ff18539270ca9e90f42cd42dea8c3cfa70a96cc2c71d61ce8a5bbfdd864515a2d0dc0c4f914
SSDEEP

96:2az0v0ZFVfNeEEEuTtlyUKiIBBJB2DIBBJBfOTFQu5bxnbYRJgi:7Q0ZFVFeEEEuBlUJBxJBfORQMxb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3660	1700	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1700	4416	rundll32.exe	82
PID 4416 wrote to memory of 1700	4416	rundll32.exe	82
PID 4416 wrote to memory of 1700	4416	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PersonMgrV108A\GetIDESN.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PersonMgrV108A\GetIDESN.dll,#1
  2⤵
  PID:1700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 624
    3⤵
    - Program crash
    PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1700 -ip 1700
1⤵
PID:3672