a347e0709c0f0d266b7c2b6f6e4f453a3d18caac5a3a27242fe9112a011ed035

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 18:16

Target

$PLUGINSDIR/DLLWebCount_new.dll
Size

28KB
MD5

f16f5feebd9b431a8bc63456c0ad267c
SHA1

acc75cfa3ed7888334aa2ccf305a6c6c58a08aaf
SHA256

5417af0fc8284e9745650a55803bb34217e314096dc7cedf113c960624ae08ad
SHA512

ed1e62d903b511a29abd5def4419b5afa63699ee2d1c91a9d884ffb01d7debe5981559574cac4885140d1f27f4275be56236f5c6f1c327147dcac8893f965512
SSDEEP

96:3YP18J49uJPeaFX/0gOtJ/9nMjbnbk2Zl1bU6i9vtmAuSBudGaTA:3f1bFX/rOtJ/lMvbfJU6snpYdb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4432	3216	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 3216	2568	rundll32.exe	16
PID 2568 wrote to memory of 3216	2568	rundll32.exe	16
PID 2568 wrote to memory of 3216	2568	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLWebCount_new.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLWebCount_new.dll,#1
  2⤵
  PID:3216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 636
    3⤵
    - Program crash
    PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3216 -ip 3216
1⤵
PID:2260