d72702999c526afaf6f6341889d5a21dd02595c6108e040b8d8f75a03d4c5f5a

Analysis

max time kernel
95s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 17:21

Target

$APPDATA/mIRC/bin/dll/mircustom.dll
Size

4KB
MD5

bfe2cf7876a8d40e43557694ec1d3f6e
SHA1

784634fb52be39de93c363626823c28a88bad56e
SHA256

c1602aa533fb2a4261fa6174ef32d66e91e325bf8b6ee8d7487e74e2982d1183
SHA512

65dad85242b2fa6fc720062ab4ae8c6539bad779326f264aa841b3941abd471f9720a6b0a1c59a1824214b783eefbb7bbb3cbe3b9fd0aa731287af5d87cf57ea
SSDEEP

48:SPWzS0AA0BfNRfC4XtMZ6159JzUjbl42vVaE/pbn/P0lwGQdN5u25h:ugS0Z05e49w6X9JQbl42NP9vdG2P

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4104	5060	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 5060	116	rundll32.exe	83
PID 116 wrote to memory of 5060	116	rundll32.exe	83
PID 116 wrote to memory of 5060	116	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\mIRC\bin\dll\mircustom.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\mIRC\bin\dll\mircustom.dll,#1
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 552
    3⤵
    - Program crash
    PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5060 -ip 5060
1⤵
PID:4348