5443b1c3aa80091b7e0d86681892e0871a7f1954dfa5cfd33318bc597116dd52

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2024, 15:02

Target
$PLUGINSDIR/UAC.dll
Size 16KB
Sample240321-sep6eaeb39
SHA256 6d7e8070fa09cc4bb66fb99c2b88d0f5419602fa64a519437f430d9378300b1e
MD5 acfb66ee6fc1f4266229ec6098fe1740
SHA1 e1aeb31b11996015d7f17308e2f2bbe69d4e1476
SHA512 bf0b5b22c57c08c88b4cbdd75bdf0c8eac433d42b4d163349391b71bc44d913e4d0e28e0826a7c27b418e6d2aa37c08c90577b56baa946a8f129486fbe01c303
SSDEEP 192:u9ALVfpLcFB5yoMINGXZ8YJJS6gGi21FNZRfUOPwiAGQMAW5s+2oA5D8t8A:SAL/S0xIkZ8CL7hfUOPGMAW5BkDod
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	1980	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1980	1952	rundll32.exe	88
PID 1952 wrote to memory of 1980	1952	rundll32.exe	88
PID 1952 wrote to memory of 1980	1952	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  PID:1980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 624
    3⤵
    - Program crash
    PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1980 -ip 1980
1⤵
PID:1288