02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 17:59

Target
$PLUGINSDIR/inetc.dll
Size 29KB
Sample240309-wkpcvaeb57
SHA256 37adc0183d94ae6ca1895643423dac0c97750d7103e6b00c14299dfc4ad2271e
MD5 dccdcb124064a1d9a5eb12232348b898
SHA1 f294fac154cb1c6c18fe054ac584f767594b93fb
SHA512 bd89bcd513bb7120db80e1115b4caceaa18c4ea863fe29b232002d447c3813133ff2849fcb2d4df45e3ff67e0e0d9d340d61060b9c74045b17efa5b1c1f5b05e
SSDEEP 384:c4Z8sUAUNuGGsPVPEZ+OLkCnFJDhgvZwcRa9h9S4y4fO7nYPLWUHWteM9Ms8:cG8sUAUnt88CFJDhmajMAWtsP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3452	4400	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 4400	1908	rundll32.exe	84
PID 1908 wrote to memory of 4400	1908	rundll32.exe	84
PID 1908 wrote to memory of 4400	1908	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
  2⤵
  PID:4400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 624
    3⤵
    - Program crash
    PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4400 -ip 4400
1⤵
PID:5088