eaa038a0020fee7ddfe2919203f20f15ca1d7eb19d90b168cade93b5cf8d7f43

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 15:04

Target

$PLUGINSDIR/xpbpx.dll
Size

104KB
MD5

4eb0e08649f542fd0e44bef7845956fc
SHA1

5fac196ee8af08f8f954f3086c0250a905986c02
SHA256

15ed84b6d171b6b6834aa6a39150b6165b2c83411929a8c6963b6e446df44ed1
SHA512

de809b359ccd7b65b41fd8320a16793c74ae1eecfee3f25d8a9943ca4d2cda675733794ec944e11d62fcd0f6ad9a0bfd7748e74841c68c6796255235b3d0b68f
SSDEEP

1536:oJUmgGAYhReTNsu0yGLmQEQoOoLz8I5EgZ2UlH08mAiI3Wklk9ncobUfsQzt2jwM:CUmgGASei2EAPP3xlkrEmP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
892	2548	WerFault.exe	89

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2548	2388	rundll32.exe	89
PID 2388 wrote to memory of 2548	2388	rundll32.exe	89
PID 2388 wrote to memory of 2548	2388	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xpbpx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xpbpx.dll,#1
  2⤵
  PID:2548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 700
    3⤵
    - Program crash
    PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2548 -ip 2548
1⤵
PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:1332