e1730af9a9c0712d32df5087f7cf548113eea3fa6852bf1483d1b2dbe846b90a

Analysis

max time kernel
91s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 15:30

Target

chvsharetvplg.dll
Size

80KB
MD5

b6a47cad0f3970d2cf70226912ba9ce1
SHA1

a7f84dd521a5c52be2744b80c24a1493a63e3022
SHA256

9ddd9956c94c609790ea9664bf2ef1c3028969d9e834227eef83acf1cc092e96
SHA512

4822bc10bb50d44f80f580dd746af040b2b89b48c2159bf022c6c499db398fa1411daedde66b39d472442215b861c63da2b70e52c06133423ee7748046c3539f
SSDEEP

1536:C2LtqNdxVd1tpd+TgE2K3fDbg6tHA7QXYeDYv7oAsmNr3kywozAL366D5Az/X:C2LtqNdxVd1tpd+0e3fDbg6tHKyW7opu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1756	3828	WerFault.exe	69

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 3828	4176	rundll32.exe	69
PID 4176 wrote to memory of 3828	4176	rundll32.exe	69
PID 4176 wrote to memory of 3828	4176	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\chvsharetvplg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\chvsharetvplg.dll,#1
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 612
    3⤵
    - Program crash
    PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3828 -ip 3828
1⤵
PID:5096