b87ecdb8035fa8b5ce87570d757265182a9f49122a02e77dc7f414816cf4b511

Analysis

max time kernel
115s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 11:31

Target
$PLUGINSDIR/mahyiit.dll
Size 105KB
Sample240401-nmt24sdg26
SHA256 0eaec60342b2074da968f010e592ad52c8b7dbfd72759b97f999f0eb88861136
MD5 b5d0f9fbb3df9a1a42b479fdd334417c
SHA1 f0780dbafbdb20235c97a28cc0ad8e1abc1547f3
SHA512 3bd39726feb5b0b946e6b29c17a12ba044bf2d0e5374c217527542a6a6f09f65e3944007d0427936178e5c485bede8631caa5738d0be50ac291759fcdd4ec26f
SSDEEP 1536:wmFgGAZxpEuLPsu0NR7mNzUK2q8fIrzcYyKkRrIAHaqsWnvf3WklE9ncobUfsirl:FFgGAaus+eyvKjxlErGrz
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4768	3248	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3248	4876	rundll32.exe	91
PID 4876 wrote to memory of 3248	4876	rundll32.exe	91
PID 4876 wrote to memory of 3248	4876	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mahyiit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mahyiit.dll,#1
  2⤵
  PID:3248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 712
    3⤵
    - Program crash
    PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3248 -ip 3248
1⤵
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:1848