5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 02:41

Target

$PLUGINSDIR/System.dll
Size

12KB
MD5

acd12e950b2ced1b5690f682d2c15b25
SHA1

639a1d0aaf669896377074281186cb6372811fd6
SHA256

6a28f1529bd59bc04f0519e086d2946ec4f09f5e4e6f30d2afb3c3585001dccf
SHA512

131bd07208d2d8c18ee9da36ce95e3c4a8d8acbb55fa96fc5a0affbc1d6e6b0ca733e9dd70ef1d5a0e15f91d88dbe1fe2c0656ea80b5a51e536ac54ab53110b4
SSDEEP

192:qA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:+R7SrtTv53tdtTgwF4SQbGPX36wJMw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1392	4940	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 4940	2116	rundll32.exe	87
PID 2116 wrote to memory of 4940	2116	rundll32.exe	87
PID 2116 wrote to memory of 4940	2116	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:4940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 612
    3⤵
    - Program crash
    PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4940 -ip 4940
1⤵
PID:2224