d89070bc1e8ca3d464f015dcbc6b2fa0076ba45946151339b0b5a9ffbdad8cc1

Analysis

max time kernel
95s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 07:56

Target

$SYSDIR/pncrt.dll
Size

272KB
MD5

13001eb0a58b4de96126b16ab15fd8cc
SHA1

4dfe6d2d02e9fa194f4af3d054b458b5a4bafbe6
SHA256

e983aa97fe1ce6af92f06433a71e03f54d3fc78392e26691cace927094bab8d7
SHA512

1a7c052bc1e7c824a3aff5e27c5cbd0720893e341dfb93062021b82c3a6d940c4ea23cbcdfaaeb174d90f51c36f0d8c62f693766f42172f894b6b689d26f49b2
SSDEEP

6144:3m7wHLiH0k6OgfjvQ0mvlxZ/PeT8Ah8EoHiIKaGo5RpTufufVvtr+dj7GcuT1JOy:3m7KLiHl6OgfjvQ0m93/5q+iIKaGo5Rr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3580	3140	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 3140	4168	rundll32.exe	84
PID 4168 wrote to memory of 3140	4168	rundll32.exe	84
PID 4168 wrote to memory of 3140	4168	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\pncrt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\pncrt.dll,#1
  2⤵
  PID:3140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 604
    3⤵
    - Program crash
    PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3140 -ip 3140
1⤵
PID:3132