557c52ce5b2287387b843a22af6e4b84b200f67e4c869a7812f713b050d73f9a

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 11:04

Target

$PLUGINSDIR/DLLDownLoader.dll
Size

28KB
MD5

0d613461983c6a2ed1be2e57b67e3ec7
SHA1

274e134bff3a1cc2b15b84f5c7d42f039ce0504f
SHA256

cb0b9edbf618082037aee9c618a7e28da3f66fa01210b425c08ddacd65bdc44c
SHA512

cbf8f2d9612740ab697ed495011cd7ffe2a6873f229374c0d0bc034bdfdfe07d5f65d8f6b6835db52ed8c133bfe141ff5bf08c23065902701cfa90c468b8911d
SSDEEP

96:t+RBpCB8OnNWxYeUXiJsVgcAOErirmYDi1w32wJVoilgtxMTuRQTGo1Qlo:t+RKDnYUPScymr1lGwJigaxMTZTNGu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3216	4276	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4276	4460	rundll32.exe	86
PID 4460 wrote to memory of 4276	4460	rundll32.exe	86
PID 4460 wrote to memory of 4276	4460	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLDownLoader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLDownLoader.dll,#1
  2⤵
  PID:4276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4276 -s 664
    3⤵
    - Program crash
    PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4276 -ip 4276
1⤵
PID:4828