3c803e52fe005b478351638f6015604bb6a5cba23539860fed9455c093e92be9

Analysis

max time kernel
137s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2024, 01:34

Target
$PLUGINSDIR/DcryptDll.dll
Size 18KB
Sample240205-bzg7vsffc5
SHA256 db8917ced7cdce480313476ddcf5ebf700fed92d0a347f1db96f47cb5378422d
MD5 e8192915d70fcb1107486e48b3b16a7a
SHA1 ec9d2eba81dbc631c907c6b0a3cbe55897f1325f
SHA512 86ad3eff31a22b31f1619d24469c41db0075bc5aa2590603a70b377766197589135bea53be1687b9f136eff4608529202da7b40de94e2342cda7ac6dd74a5a33
SSDEEP 384:AZyQSewDbPmRqcXx2kMPrd9cbkUmR08EMT6:AbtwnmR/xQdckUSEMT6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	1384	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 1384	3336	rundll32.exe	84
PID 3336 wrote to memory of 1384	3336	rundll32.exe	84
PID 3336 wrote to memory of 1384	3336	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DcryptDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DcryptDll.dll,#1
  2⤵
  PID:1384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 600
    3⤵
    - Program crash
    PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1384 -ip 1384
1⤵
PID:4088