f40fdc94d6692812e7ad056d5c5b5a7c212baa7abff156ed1de0b2a3bf17f2dc

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 07:15

Target

Miranda IM/Plugins/IRC.dll
Size

324KB
MD5

dec4a40cd7e614dee5835d0ad3068e04
SHA1

0b43be6c6a9a49ed8889aa9ac58a087f8551950e
SHA256

25b558bca2ba89b00e6c07a9b1404d16fc41e2649b00a53d5d686a5273f9e64b
SHA512

c976c13a654527afa0104af6c44504305076e96852d324ce8687416b2e8d94fcf7e8a05fac2cc7c142b141001f543f20dac20a821aff450bcf06419f692e32f7
SSDEEP

3072:n/tKw8ZE9cABn52a+MfPbD6ph8la5inFT60T+Pq10LPkvffewj6lL9DzEXwu:nQyBn5frn6bQEsj+Pk2w+d9DzEAu

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4496	1364	WerFault.exe	87
2612	1364	WerFault.exe	87

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 1364	4580	rundll32.exe	87
PID 4580 wrote to memory of 1364	4580	rundll32.exe	87
PID 4580 wrote to memory of 1364	4580	rundll32.exe	87
PID 1364 wrote to memory of 4496	1364	rundll32.exe	93
PID 1364 wrote to memory of 4496	1364	rundll32.exe	93
PID 1364 wrote to memory of 4496	1364	rundll32.exe	93

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Miranda IM\Plugins\IRC.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Miranda IM\Plugins\IRC.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 616
    3⤵
    - Program crash
    PID:4496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 616
    3⤵
    - Program crash
    PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1364 -ip 1364
1⤵
PID:4412