79551a4bc7453a47bf6ecabe218c80f7d8d57bb41a9900541d86d990b5cc8188

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 16:24

Target

$PLUGINSDIR/PictureWindow.dll
Size

46KB
MD5

28dd6576acf4b9ecdf7ce40844e00e82
SHA1

0d2416235f377e0afee423d32061c555ac728da8
SHA256

18e088d260b7e0032b176f8b3979b1e721f44b11c08ebf16c8073a1bf42f9d09
SHA512

06df7675def856acc051f95d31ea90a06ccf43c663cd4cd4a6c5824e4cdb2ceaf8c686ca3995fdacc1107b8c517236627471e0934412462670e49f29e0f2d063
SSDEEP

384:xQrfTJuM2VpBPwUUcN63RBUwcZ18rVjLjHSjQd94CB8FwkMnYPLVi9heMM:wfNZ2dYU30wrUrBLujQnPeF3MBc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4664	1512	WerFault.exe	87

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1512	2992	rundll32.exe	87
PID 2992 wrote to memory of 1512	2992	rundll32.exe	87
PID 2992 wrote to memory of 1512	2992	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PictureWindow.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PictureWindow.dll,#1
  2⤵
  PID:1512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 640
    3⤵
    - Program crash
    PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1512 -ip 1512
1⤵
PID:4712