717374926f2d2a078ef2a541497ce30e7a0283add5b111251ec8a41ecd200bb2

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 11:07

Target

$PLUGINSDIR/System.dll
Size

12KB
MD5

acd12e950b2ced1b5690f682d2c15b25
SHA1

639a1d0aaf669896377074281186cb6372811fd6
SHA256

6a28f1529bd59bc04f0519e086d2946ec4f09f5e4e6f30d2afb3c3585001dccf
SHA512

131bd07208d2d8c18ee9da36ce95e3c4a8d8acbb55fa96fc5a0affbc1d6e6b0ca733e9dd70ef1d5a0e15f91d88dbe1fe2c0656ea80b5a51e536ac54ab53110b4
SSDEEP

192:qA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:+R7SrtTv53tdtTgwF4SQbGPX36wJMw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	1648	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1648	2232	rundll32.exe	94
PID 2232 wrote to memory of 1648	2232	rundll32.exe	94
PID 2232 wrote to memory of 1648	2232	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:1648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 612
    3⤵
    - Program crash
    PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1648 -ip 1648
1⤵
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:3856