12d5b28d22d8d902d3258d92278299836df03171df250694cf7f55f0101c216e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 16:08

Target

$PLUGINSDIR/cppahhz.dll
Size

153KB
MD5

256a4fd5061e042b52c698808fa161cc
SHA1

4ab8bf6233e87efe2bc7cdce908a894854ca523c
SHA256

3c857fb04ef9e3ecef14cd2c6fc8e19d2b44fe699d0dc9ef1d467731a61cb916
SHA512

6bd24d68bad8763b4e10ab6596dd23f609319d5aa6472f408ba6ccd2bab61b7c1f514337e11963ef076d65cc4b25d0914390a3aecbd1c80b4f785a984ff8eea0
SSDEEP

1536:GS119M9GRwN24gkykW/EEZsu0IXYKFhijQZ1Dyfs7/K0Xg8XmiXSPRzh8CAdwJ+P:Gg1m+ycrd/bXg83XETAGm+AG/XsVi6M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4904	2492	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2492	5116	rundll32.exe	14
PID 5116 wrote to memory of 2492	5116	rundll32.exe	14
PID 5116 wrote to memory of 2492	5116	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cppahhz.dll,#1
1⤵
PID:2492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 608
  2⤵
  - Program crash
  PID:4904

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cppahhz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2492 -ip 2492
1⤵
PID:2448