aae8a8a2c89affb397bef75650d193b40c18c7c7fd15144933543cbbf7e78acc

Analysis

max time kernel
96s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 21:40

Target

100% wh/opengl32.dll
Size

21KB
MD5

bb06295285008054f66e2bfce5e08690
SHA1

5ff0c8a3f65f0c0b680650c1bf0390992dce8d60
SHA256

012987d753d3f4ee50a05590b04bf62e1f53e6d66b5cee6813db92f622950ac7
SHA512

96105c9e406acce42f0e78ea055de25770f2b197a03746f845f08c8caeb133c533671bde284ec498466b4ce9e651bc7d6d6b14a176578b3e2e8f5849827deb52
SSDEEP

384:LKi0CK+colcf6fcv1aZ2yjiSY22u1yCO5ld1dnCtCAGVR0Axqr6+S9Pfu7n58:L6CKJolS6fcSiRBu1yCqBnCtCAGVRHxV

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3200	4020	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4020	4464	rundll32.exe	83
PID 4464 wrote to memory of 4020	4464	rundll32.exe	83
PID 4464 wrote to memory of 4020	4464	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\100% wh\opengl32.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\100% wh\opengl32.dll",#1
  2⤵
  PID:4020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 544
    3⤵
    - Program crash
    PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4020 -ip 4020
1⤵
PID:1712