bacf1ae72d809382dc9ceba302a3f1fc91542620767e9d34e5caab2a2619e133

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2024 05:41

Target

$PLUGINSDIR/SimpleSC.dll
Size

48KB
MD5

72b95a219d2525f9b1c2213ab9b8556c
SHA1

de5b369a18b8701ebb6852d3a4b0d55213f789e8
SHA256

0b6b5ef0835c570c4330e597eebfa00c2a13d4c5f043283b604e585fdaea6b4e
SHA512

2e31684638d136049c89cecee7a86360933845a0f115f145150b31a144bdd2b621d779392e14b0504e40c19a0c8e23a50f8b3534bc002b12150aa6cf12696596
SSDEEP

768:AutqkcrJvsz+w+S9CoMY7If7gQ1To2rIF/wYpyFmQAw1+04VtD//1GV4MCR:rtqkcrJvsRLMYcb1nYpyoLOwCmMCR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4640	4636	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4636	2960	rundll32.exe	18
PID 2960 wrote to memory of 4636	2960	rundll32.exe	18
PID 2960 wrote to memory of 4636	2960	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SimpleSC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SimpleSC.dll,#1
  2⤵
  PID:4636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 620
    3⤵
    - Program crash
    PID:4640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4636 -ip 4636
1⤵
PID:4256

memory/4636-0-0x0000000000800000-0x0000000000810000-memory.dmp

Filesize
64KB

Download
memory/4636-1-0x0000000000800000-0x0000000000810000-memory.dmp

Filesize
64KB

Download