3383e5ed89a4703ac88c7b8bfd322fb56d035e0dc4c9bb48be02b564e28d1818

Analysis

max time kernel
140s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 04:00

Target

$PLUGINSDIR/spdfabbx.dll
Size

105KB
MD5

a0f13c3729d70aa371add5038a1336fb
SHA1

c87d35c652abf87932fd9f1ba77ecc62e0a2281d
SHA256

03b50dc7cd5d915c6a19efd60a767fb3582913f23c231223fb6b44f7bde594b2
SHA512

09d2b2fd0dec0bf68a86bfeb4df9236dccf176f9135953984f5a69cd86b10001d3a71db30e09c6c91b20e561933574af2dbaf4bd406587b46b0c19630137be1c
SSDEEP

1536:wMUmgGAXhfejHsu0Oj0mSCeo/JJmwi0EpzRYAFV24kKnHjhPCkzue3Wkl/9ncobI:rUmgGAVesYtzlE59BHxl/r9pJ6e

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1712 2120 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1712	2120	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1216 wrote to memory of 2120	1216	rundll32.exe	rundll32.exe
PID 1216 wrote to memory of 2120	1216	rundll32.exe	rundll32.exe
PID 1216 wrote to memory of 2120	1216	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\spdfabbx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\spdfabbx.dll,#1
2⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 696
3⤵
- Program crash
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2120 -ip 2120
1⤵
PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:3300