79af1f9153b8ff988baffaa164fc70799950078f887e2c93dc3fa7efed674b21

Analysis

max time kernel
302s
max time network
319s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 22:20

Target

$PLUGINSDIR/System.dll
Size

31KB
MD5

dab726bff7cb0f079d232b2c4d0efd8d
SHA1

4d0ebe0facbb66c9c03e3f6b5beb411cb75d9ec9
SHA256

9d46463e1925bf29cd86c7a56ccf540f1eeef3cb50064a222b84703436cd7e8c
SHA512

6aa6097777afdcb073b8fc8ace1a244ac9215ec152720d8b4a32f6196181b135a900491c7fea72bf1df9ed69e51b90cd21eca4ed902d8503d0b1b04c162a2162
SSDEEP

384:Q/h37/UFERnoxFtgQw+S4nebga3ZBB/Ykv44IwwH9tPPPPPPPPPP6MIkwQeKe/u+:QNQyVOFSR+SfTZlvCH91ze3WAz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3200	4192	WerFault.exe	97

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 4192	812	rundll32.exe	97
PID 812 wrote to memory of 4192	812	rundll32.exe	97
PID 812 wrote to memory of 4192	812	rundll32.exe	97

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:4192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 612
    3⤵
    - Program crash
    PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4192 -ip 4192
1⤵
PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:8
1⤵
PID:2160

memory/4192-0-0x00000000751E0000-0x00000000751F0000-memory.dmp

Filesize
64KB

Download