b11fa6b0699d9f9c43be01194e6383348ee504f78863454d26e048fe61397518

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 13:06

Target

WebBrowser.dll
Size

332KB
MD5

045337ae806bba0e02e5a04ec3345b1a
SHA1

24f52d598389d5db64de203f16b3189cec4eb7ba
SHA256

ce1549d063ffcb2f0aa8e0c520de09a4eaf6cb53e49afaa666a58857cf7c27a6
SHA512

d52c01484b3083ed79cd1e03e700290f96c7967ff5239adb1dcceef589cb37f35389910345afd3c5f122ab35cb45514bf7eaf5d1eeed3b2065eb2f3d0761d877
SSDEEP

6144:ckSokatLrfWZIO56EKavmkAusUuOcjj+W4UBLbRbeFth09CwVCVeECP467vRJHrT:fiat3WrKauWduOcfNl59CEg6bRlT

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4148	4856	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4856	4648	rundll32.exe	85
PID 4648 wrote to memory of 4856	4648	rundll32.exe	85
PID 4648 wrote to memory of 4856	4648	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebBrowser.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebBrowser.dll,#1
  2⤵
  PID:4856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4856 -s 672
    3⤵
    - Program crash
    PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4856 -ip 4856
1⤵
PID:3476

memory/4856-0-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/4856-1-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/4856-4-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download