1a212857d3edcfe44cfdf0ac50db27a1fb325721f7fd9aa9a1e8fcc8b4bda64c

Analysis

max time kernel
92s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 00:13

Target

$PLUGINSDIR/pathedit.dll
Size

227KB
MD5

472b1782f3e5a9f4d182abf6d3d303c5
SHA1

6d2b041189bf8d350f2eb9e8b0c21e1c77590047
SHA256

07d2f4173b3518a99c63b8ff316b5edfbdf0018331be774a3de9172a60e7322c
SHA512

98abd505b4e763b1da38c887f316db5a40515e7a1ad7650aed56ddd9f45c9d84151726a5cbdd7af3c29746b4868089550a74b125f075949e6f9621a5aefe60f0
SSDEEP

3072:y2zI5yma+6agPKbqvq6d5zHYQrxNKQBPvy0t5pXcTQJA1R3uAg0FuD0mN13XzV5Z:bIAhquHB2EHy0t5RcT6AOdz38AqeNI3M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4036	2296	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 2296	944	rundll32.exe	83
PID 944 wrote to memory of 2296	944	rundll32.exe	83
PID 944 wrote to memory of 2296	944	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\pathedit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\pathedit.dll,#1
  2⤵
  PID:2296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 612
    3⤵
    - Program crash
    PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2296 -ip 2296
1⤵
PID:3980