19ffddf2e9e4958d30a147598268fcf3e60bab780384f5f9fa34e20a075a4812

Analysis

max time kernel
82s
max time network
91s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 15:10

Target

$PLUGINSDIR/CertCheck.dll
Size

15KB
MD5

aed814f87d862cb5ceb00fd0a6d60fb8
SHA1

097418e9181e6b4d95f40410cd4dd962fe27c41b
SHA256

d56e2407b6050d669e94e452f1a54ee1859a1751179a3f1e2b4253305a23a0cf
SHA512

69593e12efe0736ada5a9e1b6f3c238a6434b88068361dfd2f7bb3e50addbf9b56ccaee30321362ce085ea700fbab03bae8494bba8c72e9e9983d3faa569b3d2
SSDEEP

192:xVLS6KjE7x0KDWpHFtH6cAAANa3Gy2sE9jBFKWJfsHRN/M/X+6Yt7onk:a6zvDGFtart8E9VFK4iz/T5mk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1652	4280	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 4280	3172	rundll32.exe	86
PID 3172 wrote to memory of 4280	3172	rundll32.exe	86
PID 3172 wrote to memory of 4280	3172	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CertCheck.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CertCheck.dll,#1
  2⤵
  PID:4280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 636
    3⤵
    - Program crash
    PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4280 -ip 4280
1⤵
PID:4748