df5039197d98afa27ede1f1a8de46052de7ae716fd87d68b949b87649014b366

Analysis

max time kernel
115s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 16:14

Target

$PLUGINSDIR/czqp.dll
Size

24KB
MD5

d4e1b723e7687c5c404bc81cfce6a5ec
SHA1

dd6d741f860eb6ee59aab7455d895c2e0f394a55
SHA256

ae58d3fdef96fa5a1525a7ced314231b4883ed796fe8a42958d5bf24b21fa64d
SHA512

359c32988a018748b157fa93f38c6ef92b28508cbf86ca129218848679b009fa630d31198ce85d9c31e8815c24aeb8be428c1e882cf67936df8a85bd542d8a3c
SSDEEP

384:7reSw0JDTRCNzQL+LWJYjnZjHGTjA4CbuP9Wuud9QQh8xf6LPvtTbMqg:DwwRCBnWJIntmTKBuaQFOPFTbM

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4456 3844 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4456	3844	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3604 wrote to memory of 3844	3604	rundll32.exe	rundll32.exe
PID 3604 wrote to memory of 3844	3604	rundll32.exe	rundll32.exe
PID 3604 wrote to memory of 3844	3604	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\czqp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3604

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\czqp.dll,#1
2⤵
PID:3844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 688
3⤵
- Program crash
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3844 -ip 3844
1⤵
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3968 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:2732