e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 13:05

Target

e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce.dll
Size

240KB
MD5

0415a495afb5e811881209cce7d496aa
SHA1

2cfa5822ce6607acc558091d8ea8b4344f12f72a
SHA256

e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce
SHA512

7974d4d445bbbf067c9fd4756e61fad84eb3342ee5625e685d583108bc12511bda3af2e60f479a613997f1dcc922841bfa192b9184b5367c3f3fc537e19f7e62
SSDEEP

3072:/Cc5B9t5RVp8r+n8thbxaCPmldQDzdjIs9OThDGpzioMQDk0496Z:qc5B9hc9hoamOdjkmkm

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\GRGDTATM_CommCfg.ini	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2428	4080	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 4080	208	rundll32.exe	83
PID 208 wrote to memory of 4080	208	rundll32.exe	83
PID 208 wrote to memory of 4080	208	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e8594373f9a2348eae42be85909bab85349e7acc62c4a7d7f9e088ad736a33ce.dll,#1
  2⤵
  - Drops file in System32 directory
  PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 648
    3⤵
    - Program crash
    PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4080 -ip 4080
1⤵
PID:2408