332bfd0847514e8f4f9f943bad7d3b35b3915faf662ef11feb7db82fb322e11c

Analysis

max time kernel
90s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 01:28

Target

$PLUGINSDIR/FindProcDLL.dll
Size

32KB
MD5

849abe37c3b8a6dd48089b769ee789c5
SHA1

81d5d6c4d6328059a07ae59878c717211a726512
SHA256

0ac175b28d2a156e71bda214d4a35321c85d434e325624564f0a5eee23c718be
SHA512

fa1f60aa1e26dffe6a0b2ee8cba6490cc2d1f94613777466ce434a71431bd88f8c3964718f3ea1dd2c8ca41847cc259999bb293ea2591f4f0a0add286229f76f
SSDEEP

384:kZgOCgkqzx8Cu8d1VKZA9dHC8rotc8dfa3FvCyj72y4hUqAbso4AH:kZhCgkqzCsd1AoaWUgSJORbsopH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3444	3920	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3920	4364	rundll32.exe	85
PID 4364 wrote to memory of 3920	4364	rundll32.exe	85
PID 4364 wrote to memory of 3920	4364	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FindProcDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FindProcDLL.dll,#1
  2⤵
  PID:3920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 600
    3⤵
    - Program crash
    PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3920 -ip 3920
1⤵
PID:2576