5341b3921b75549adbe59365517c30bd045e63162728d9ba48f79832fea1bea0

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 17:21

Target
$PLUGINSDIR/UAC.dll
Size 13KB
Sample240124-vxb3lsecfl
SHA256 86445396775370aff5834f10bda25e505b6f89efc69a04fe1ce46f5d128be73f
MD5 7f56c0d6a8733dec142814ed5a58b0ee
SHA1 c119e66f179cfb758966f3cf878466057bea1840
SHA512 8b3b9bed985b3583b7be8b2197bb068e5d5508f8b5c4a7fc1278b2662dc8d9a53fd6df63f636e44bfc5aa37f030ac76b8d259d6b446bf87d5c72b74ff5b158f3
SSDEEP 384:d/lNMKbnRWKYyCvDvQH3yBf/qPNGkVWYyLrcMf9VQ8c:d/lq+RDYJf/qPNGkQ5LrcCQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1236	3040	WerFault.exe	15

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 3040	4240	rundll32.exe	15
PID 4240 wrote to memory of 3040	4240	rundll32.exe	15
PID 4240 wrote to memory of 3040	4240	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 632
    3⤵
    - Program crash
    PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3040 -ip 3040
1⤵
PID:4820