d72702999c526afaf6f6341889d5a21dd02595c6108e040b8d8f75a03d4c5f5a

Analysis

max time kernel
131s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 17:21

Target

$APPDATA/mIRC/bin/dll/dmu.dll
Size

28KB
MD5

2db18780ea5d7ff0d3cf0de32b844164
SHA1

d277db0b9f9374ce19eaba4aa82d4ae8dc5d3b11
SHA256

a5531baa8f74e3e6c46321c9c0add4b1de118887b16b91d29ca875a5b7bbabc2
SHA512

e0bedeb7497a104bc62162bfcb01b242685e550f5e3913b0eea8c715b25615de5c52dc0521fed84dc3ceb41dbb5b23d53af44654c91b66ee6e19a0d2d27e0a50
SSDEEP

384:qUEz6/424ZiZ99sYfEh8NXQn9n9+D0RpulbxpXUETlGksXQydI8wuE:vUg4o9Gh/99+kpulbDUgl1sXzK8wu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1808	492	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 492	1920	rundll32.exe	83
PID 1920 wrote to memory of 492	1920	rundll32.exe	83
PID 1920 wrote to memory of 492	1920	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\mIRC\bin\dll\dmu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$APPDATA\mIRC\bin\dll\dmu.dll,#1
  2⤵
  PID:492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 616
    3⤵
    - Program crash
    PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 492 -ip 492
1⤵
PID:4408