4e32bec63d6c3bd84610060a50c7bffb89a7e19c2d41953b613d20f3d74dba2d

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 18:35

Target

plugins/streamer.dll
Size

235KB
MD5

7477d1fa17cc49434d3f2535758d3953
SHA1

2873741669e06720718b4c05cc9512b36938100a
SHA256

e1ebb301bb05859d6aedde494c2fe7e102df0c79e1b9a575d8dee8fa0296cc6f
SHA512

60d95b90e90fa031121216e04df81e5a0b816fe49ac58712c21a3a7ed02ee75236ce98c572149d3bde2a67ac02138a010df50c83b0ae8ab3be68feca53190ca9
SSDEEP

3072:HPmx4ysuRVx9nVvPdhx6nIHQEPCYTbGyZTwKZUR7HGANOrP1zwnrOZqzxF+VC:v6DswlPD8IC8UR7mAcP1zwrOZqu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4952 1000 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4952	1000	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2420 wrote to memory of 1000	2420	rundll32.exe	rundll32.exe
PID 2420 wrote to memory of 1000	2420	rundll32.exe	rundll32.exe
PID 2420 wrote to memory of 1000	2420	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\streamer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\streamer.dll,#1
  2⤵
  PID:1000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 612
    3⤵
    - Program crash
    PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1000 -ip 1000
1⤵
PID:2568