1707bc697b6509cc471011f836effe5815d4c553a6d07eac628dd8757141c7cf

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 10:12

Target
$PLUGINSDIR/pwmzqotvoug.dll
Size 28KB
Sample240331-l81exaaf94
SHA256 5fd383ebda46cdadf9fcec02b74982cbf75688498475bbb655f18f4271988f3d
MD5 8bce90199381e2d4765729b5a75314bf
SHA1 fe94312ad5450fa37a6b4fb4557f0a18df93cb3f
SHA512 1f93e885e556ad1dc6882fc3d05bf4794fdf639f14f20a919b6bcb344eecc1fa5b28bb5c83461b4315ba01b880f2b70ab18cb6ce098b44a58d1e3088bc905e1f
SSDEEP 384:gT2ogsNzG9THkywV7wVhx1udVG4eH6tIFlykk66oXh/allX9mRBRVNSwFSg:gCFIIDk9KAdV/eHbFcrW/NROwP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	1136	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 1136	724	rundll32.exe	85
PID 724 wrote to memory of 1136	724	rundll32.exe	85
PID 724 wrote to memory of 1136	724	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\pwmzqotvoug.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\pwmzqotvoug.dll,#1
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 724
    3⤵
    - Program crash
    PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1136 -ip 1136
1⤵
PID:4656