cc8983b7309b663c1c72075936be3f57cd11b602d4f60e7a642c709823bbf294

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 21:23

Target

$PLUGINSDIR/ExLicenseDrBoanPage.dll
Size

48KB
MD5

9d017df67eb3202910016b66a7307df3
SHA1

679041deaf30d05ff6fd5b84f40d53e17df02b99
SHA256

9419910814e7fa9edb6248da63a0f72360604629de3e44cc48569ecb66450456
SHA512

d7b3702d6b1effc1f00143f92a35b2c05825889138774b9b686264639bad72570c0300039d66cb8bc78e1ace121e5da18f8a31d7e1da1a16a52392ecd74cb30b
SSDEEP

384:WTC+6JDX+jhWv0eUshsEPehLYCQ9xgZJwJyUP82ezEhKiXJIO4u:W5yXuhqS2/ehLYpDg7qZPD4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4880	2320	WerFault.exe	52

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2320	1956	rundll32.exe	52
PID 1956 wrote to memory of 2320	1956	rundll32.exe	52
PID 1956 wrote to memory of 2320	1956	rundll32.exe	52

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExLicenseDrBoanPage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExLicenseDrBoanPage.dll,#1
  2⤵
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 632
    3⤵
    - Program crash
    PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2320 -ip 2320
1⤵
PID:2540