16a6baf82a2fb1c366cc6f94c382d55172e72855a5e435c898c6429aab2edd3c

Analysis

max time kernel
155s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 23:58

Target

$COMMONFILES/PPLiveNetwork/kernel/sop.dll
Size

441KB
MD5

f7a46d933e8065ad872339aa4b69c968
SHA1

b64d12f885131ce4e0ceb3b5cdd6f6b56eeab855
SHA256

e27553f463256aa08ed026a221874a604c40ae3d8f19c37bcff7c6f1228fa153
SHA512

24ca6e9d0d8ed196f8b5f30cc2af2b14bfaa7910386a48903fc92413e2e23249f21becc00751f2057698b97ebb62576efd8ca6e4c9e5f003173b33cdcc04516e
SSDEEP

12288:v6DCYXjWaSMWCX4906BJZVY+dO9bZBdb0p:v6GOs3906BJZVY+dAZBdb0p

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2700	1240	WerFault.exe	94

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1240	1932	rundll32.exe	94
PID 1932 wrote to memory of 1240	1932	rundll32.exe	94
PID 1932 wrote to memory of 1240	1932	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\PPLiveNetwork\kernel\sop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\PPLiveNetwork\kernel\sop.dll,#1
  2⤵
  PID:1240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 632
    3⤵
    - Program crash
    PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1240 -ip 1240
1⤵
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:3500