21a03658486b940d77d0fca56f51ffeb391332b4a44dd32cc2876c7bf5e111a7

Analysis

max time kernel
90s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 02:12

Target

$PLUGINSDIR/MakeDll.dll
Size

397KB
MD5

8c21929b256feacd384ffa982fca6a4d
SHA1

5e61a8c286ab2a9f5eb918c2df2390ce2cab7a44
SHA256

41a533327a2a39a0b032027c408a962180a3a75adf5bcdafd734a50f09608790
SHA512

0d619e539f7869b1cfffa3d722ab2619214b225129b0e224087596d525c57b81661cbccce04e0fcb10aba6ff7cd822dfbd4df9b1c23edf2df142d4548aca7c24
SSDEEP

6144:67ELuk4cTX1ARqPvCudXWy3oanscbvDJQk7e2q/H8EIINRBT9fNsaKfjemm0WDl:Mk48ARqPvVaQNrqNP8ER9lsaonjO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1316	3800	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 3800	3760	rundll32.exe	84
PID 3760 wrote to memory of 3800	3760	rundll32.exe	84
PID 3760 wrote to memory of 3800	3760	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MakeDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MakeDll.dll,#1
  2⤵
  PID:3800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 656
    3⤵
    - Program crash
    PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3800 -ip 3800
1⤵
PID:3692

memory/3800-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download