08b3baa037ff1ef979544f921e7e4f023bb649c04e7aa929b2e4328cc5ac1138

Analysis

max time kernel
144s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 03:32

Target

License Terms/SqlUserInstance.dll
Size

150KB
MD5

423671a408eedd5e51f4d4f6a3de4589
SHA1

7a96a2c6e2381e78bdd152e3caef75146460f488
SHA256

b62fab3be134e7765720c0eb579be5a65ae719771b1e39c14ac39958d554b90e
SHA512

4e9aa8c9ff248d4ec86d79b8515dbe51fa30aa5b28124a2c1872270c30e7887c1d49c573116237f393c29ef431b97110212fdac9d3a27134b6effdc5d373c11c
SSDEEP

3072:bm07GntHw9i1pCiY/cYCuyaBeipTCl/0YgPjGWuwLWW1cQFaNWpVfxTdv7OH3UCb:k9Y/cpascTg/0YgPjGWuwSW1cQae5TdS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2584 4036 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2584	4036	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3292 wrote to memory of 4036	3292	rundll32.exe	rundll32.exe
PID 3292 wrote to memory of 4036	3292	rundll32.exe	rundll32.exe
PID 3292 wrote to memory of 4036	3292	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\License Terms\SqlUserInstance.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3292

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\License Terms\SqlUserInstance.dll",#1
2⤵
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 668
3⤵
- Program crash
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4036 -ip 4036
1⤵
PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:2768