50a8a27c3936baf64013435a27409f53abb3376327dbeef67aeadcfc89f70093

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 11:37

Target
$PLUGINSDIR/ExecDos.dll
Size 5KB
Sample240315-nrdwpafc6y
SHA256 b772c4d8112d1ff086ad4ba529cc802ff8f503d9003c9c73088a0240f4ba0523
MD5 375aeda248e605b726ef5f256bee34c0
SHA1 cc29301f845fc430357a660708ed8cf972d37b43
SHA512 18de4580af9298753f579eafeb083321710640c4db7d77a32ff870ebb5cc81eb5b252c7e3f6a1c448ed4f96e8a230eb3225c294f168d37821aed26699f17d7c9
SSDEEP 96:rA8uCTy0luh/H1s3ZJQ8JXHdKAeQ/YUDJhn:TTLuhVcJbdHdvLJzn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	5092	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 5092	4856	rundll32.exe	90
PID 4856 wrote to memory of 5092	4856	rundll32.exe	90
PID 4856 wrote to memory of 5092	4856	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 604
    3⤵
    - Program crash
    PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5092 -ip 5092
1⤵
PID:3660