c84323551b8814bcdf1b176cc38f197a00025817e93f6c8aefaa7ab180187cde

Analysis

max time kernel
93s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 09:35

Target

$PLUGINSDIR/wwovt.dll
Size

30KB
MD5

3db889c292904a3fcefaaea76ca6dc24
SHA1

b9e0cf954f3cbf80245e32633a01644f69a6f0d8
SHA256

15efdfbe9775fdeb2a57a01564006d1322e9f7815c8f4325d88d6403fe809238
SHA512

7abcdc3b2bcf849fa359010ebe04b587e9e7f8b3222a949f03fd5766506a0f612ab875bb205a60a7fe170002177c0a3d841965d902a175656406ff10df345047
SSDEEP

384:6X21oCNE0oHVOBiEN1EDzSW4Ys7//YriYpICfKSZP8ZWYahHT/yKetlOmdmSlmOW:6m1DE00OBiOW4L7Hw/phiZQhH7y3

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3964 1376 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3964	1376	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 3144 wrote to memory of 1376	3144	rundll32.exe	rundll32.exe
PID 3144 wrote to memory of 1376	3144	rundll32.exe	rundll32.exe
PID 3144 wrote to memory of 1376	3144	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 1924	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 1924	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 1924	1376	rundll32.exe	rundll32.exe
PID 1376 wrote to memory of 1924	1376	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\wwovt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3144

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\wwovt.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\wwovt.dll,#1
3⤵
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 744
3⤵
- Program crash
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1376 -ip 1376
1⤵
PID:5004

memory/1376-0-0x00000000755C0000-0x00000000755CC000-memory.dmp

Filesize
48KB

Download
memory/1376-1-0x00000000755C0000-0x00000000755CC000-memory.dmp

Filesize
48KB

Download