26a7d60148b01f0b2c57abaac977514cbc0d31606ae151f200f0b9c04fdf0ad3

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2024, 18:38

Target
$PLUGINSDIR/pclcfdo.dll
Size 22KB
Sample240330-xaftdscf46
SHA256 824fda5608b540d3bda797751450c40649565f2bf49afdc81ebfd9faa8995aa2
MD5 5083f0592bc9096bcf547e329f4c17e0
SHA1 12735d4c3772cc5ae3efb52056262ff37e55f945
SHA512 6f58a78962ff9bf04c05d61ab95d24cfa183a3e5288cb4365b065ae5c349baebd870987803014dc240449a360a6368ebc48184547719c80f6683cf5f0e9160c9
SSDEEP 384:OenMTlcY3sNkzLuFWGu7GdKGd/ZxJGf8wPNq4htK7RvU:OeMT+YcNkzLuFnEsKsG8wVZPK7
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1536	2976	WerFault.exe	85

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 2976	1608	rundll32.exe	85
PID 1608 wrote to memory of 2976	1608	rundll32.exe	85
PID 1608 wrote to memory of 2976	1608	rundll32.exe	85
PID 2976 wrote to memory of 2632	2976	rundll32.exe	87
PID 2976 wrote to memory of 2632	2976	rundll32.exe	87
PID 2976 wrote to memory of 2632	2976	rundll32.exe	87
PID 2976 wrote to memory of 2632	2976	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\pclcfdo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\pclcfdo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\pclcfdo.dll,#1
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 752
    3⤵
    - Program crash
    PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2976 -ip 2976
1⤵
PID:1488

memory/2976-0-0x0000000010000000-0x0000000010009000-memory.dmp

Download

memory/2976-1-0x0000000010000000-0x0000000010009000-memory.dmp

Download