e3bef3c169ed317c459bf9d52958a6ae4d4bf753ba6224ee4878e6bbddca067d

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2024 02:03

Target

$PLUGINSDIR/UAC.dll
Size

13KB
MD5

b0151ae4287a740988b242c5cf715032
SHA1

db33b1f1d7e9c3346f06c360e102a3fe765a0522
SHA256

60314da07d2dfd677408c32c768e0f6cdeee94c42ea8ee2b94ad8fa3789259b5
SHA512

bee28871ee4711759dc3748a622c8cd748045398bb392179e20e53aa32d049fc89c3952d0123885ac46aa6d225bb7b821dc7532160230c5a396e930530139b7b
SSDEEP

192:yWjgr9lWIs6YwW2T8/JbIYu5vEQ1hGkG7OCF2YCinfDdvWjT7bTR38LnURr7k5:pgBlW6YFB07JErXz/tMT7bTRMUA5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	2244	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2244	1960	rundll32.exe	84
PID 1960 wrote to memory of 2244	1960	rundll32.exe	84
PID 1960 wrote to memory of 2244	1960	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  PID:2244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 624
    3⤵
    - Program crash
    PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2244 -ip 2244
1⤵
PID:3456