23641b1b717d089e09858d42a5b0627e239bb54980b81574fc5767793c6f8341

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 22:56

Target
$PLUGINSDIR/ExecDos.dll
Size 5KB
Sample240407-2wva5ahb86
SHA256 d387b725afbd2a6f9b44999278d21025fae55b391e45f7751b88dfb13511a993
MD5 ebcf9f71d804abab3c2e5ce4c17dc22e
SHA1 17d13084e75cbfa5fbfdd0025e9a0ee5772ae765
SHA512 5576396c2d885c039668d7f401eeee583eb4de39e8497c3aaec32d47f4417a522fe6786c111d50a5fba7570f50e84144ef3a8aea42677d170e79114343c3a4a1
SSDEEP 48:qNpugCjmWaZ+rnHAUiP9JLw/RHFtly5vorpSpSi7+5HCAx31Oglt6Zlrz9QH96AD:r0W1nHAfPPORHnooAU3xYglt6WwE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
400	4468	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 4468	3460	rundll32.exe	85
PID 3460 wrote to memory of 4468	3460	rundll32.exe	85
PID 3460 wrote to memory of 4468	3460	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExecDos.dll,#1
  2⤵
  PID:4468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 600
    3⤵
    - Program crash
    PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4468 -ip 4468
1⤵
PID:2824