e791985263b2df4b00652a69f4d6ac925dd2e7a069b9cc30ccb6fc5c813ec44b

Analysis

max time kernel
135s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 03:10

Target

$PLUGINSDIR/gplunger.dll
Size

139KB
MD5

bc5f89eaab81e7b404f5616536129cfa
SHA1

00e44b6e9327939b5db0931574dc5f1fccde7056
SHA256

3d76a243d61f3115828ba4fff522ba77787bf8ad3478f9310b5226da064f1a7a
SHA512

1bcb59fbc4c155c2892deed891dc47034ad3c4e078cedbbbd9828811b97cff6dfe111640b4ff195976df7f321d957e3b779085b6e5425593a71d4a948d38de63
SSDEEP

1536:22Wi0TsEfM+ahZ9crL6zX6sl4iqhmZC4WvmYRREMmhXSFwLtjCxmbSJ5cXuUH6:2dCTiIX54mtYrETCF8tjC8q5UT6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1324	3276	WerFault.exe	45

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 3276	768	rundll32.exe	45
PID 768 wrote to memory of 3276	768	rundll32.exe	45
PID 768 wrote to memory of 3276	768	rundll32.exe	45

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gplunger.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gplunger.dll,#1
  2⤵
  PID:3276
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 624
    3⤵
    - Program crash
    PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3276 -ip 3276
1⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4016 --field-trial-handle=2276,i,1205556100727695622,5044463180471657307,262144 --variations-seed-version /prefetch:8
1⤵
PID:1896