2bba05f9769bd1ae9620ad64421955575bfbdb145e551bedcf55cad61a0819e5

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 14:12

Target
$PLUGINSDIR/ftzcfimfl.dll
Size 31KB
Sample240405-rh56cseb51
SHA256 c8b41f14eb72a177801664827eb9942534a410678a37894566fd09fc7e7dbcb4
MD5 25e960f61eb87320c923a7cd60280f35
SHA1 849dfc82b9ff6235c663993ba9924ab1f2a0213b
SHA512 42f3fc92d9b2778c3a8d5ef9edce3e8778b2fb414b59573efdcba88c4b73245c4f255cd15a6c46f77a30738bcf8e3636bdddd28be7df81403755400ebef71270
SSDEEP 384:5pHCFR+Fe3ffVNHKFOQAFVVK9rl0ngCz4QWm81g3C7X8C4oVYQ20oXQ7KudmrdA6:/CBPNpKFaXgrPCz/8jXemYQotudmZA6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	4656	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 4656	532	rundll32.exe	91
PID 532 wrote to memory of 4656	532	rundll32.exe	91
PID 532 wrote to memory of 4656	532	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ftzcfimfl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ftzcfimfl.dll,#1
  2⤵
  PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 788
    3⤵
    - Program crash
    PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4656 -ip 4656
1⤵
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3992 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:1044