5cfaec15d48d36b15ac725930e3203e30e40bf17fc0d11de83d5e4f42a0f717c

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 15:06

Target
$PLUGINSDIR/inetc.dll
Size 24KB
Sample240327-sgspbaef98
SHA256 41776a77b4e3bba1c3e70d10b9f560248148b8f2c45d39d4cd8683754112860f
MD5 ef630cf1898c257df36b1037bd1e5392
SHA1 b2c47d9a741d2b5391387059552b37f2daddade2
SHA512 986b405d723294ff5b3649f899bc048c5693bd386dc3f489b390ccb1d56e8e65a9dbe6d0863d553525ce93d505a162eaa087faf4b4c5133345c3330d01327211
SSDEEP 384:TzBnI67jSmHQvw+Bf4HD4Cza5Sh2ze7VW3Pvg5TEnzuomuHya93ld0Ac9khYLMkY:TtIajSmiw+iDLth2ze78PvgynzuzuSaf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
452	2996	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2996	1732	rundll32.exe	88
PID 1732 wrote to memory of 2996	1732	rundll32.exe	88
PID 1732 wrote to memory of 2996	1732	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 624
    3⤵
    - Program crash
    PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2996 -ip 2996
1⤵
PID:1720