a0cbaa1d30c81051528609376fe68d782bed44d5ff2bc4bd17ae57ac77a18758

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 10:18

Target

$PLUGINSDIR/DLLWebCount_new.dll
Size

28KB
MD5

f16f5feebd9b431a8bc63456c0ad267c
SHA1

acc75cfa3ed7888334aa2ccf305a6c6c58a08aaf
SHA256

5417af0fc8284e9745650a55803bb34217e314096dc7cedf113c960624ae08ad
SHA512

ed1e62d903b511a29abd5def4419b5afa63699ee2d1c91a9d884ffb01d7debe5981559574cac4885140d1f27f4275be56236f5c6f1c327147dcac8893f965512
SSDEEP

96:3YP18J49uJPeaFX/0gOtJ/9nMjbnbk2Zl1bU6i9vtmAuSBudGaTA:3f1bFX/rOtJ/lMvbfJU6snpYdb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	3080	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 3080	3864	rundll32.exe	94
PID 3864 wrote to memory of 3080	3864	rundll32.exe	94
PID 3864 wrote to memory of 3080	3864	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLWebCount_new.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLWebCount_new.dll,#1
  2⤵
  PID:3080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 636
    3⤵
    - Program crash
    PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3080 -ip 3080
1⤵
PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4460 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:1248