88977075356dc9e4c81ff59e5ffc004ab3d62070c1062ce7b690a941d5328090

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 14:03

Target

$PLUGINSDIR/PCWPlugin.dll
Size

262KB
MD5

8240bee02c3ad64fe256a67479de886c
SHA1

afb6f7fede3ef1509b1be979dd3ca1ce5ea03db6
SHA256

d0a7db3315f28a3b1016b21a78d30b71d961b5979d50635c716df5c11fd1351e
SHA512

34170981f78f77814c6869f3833631726c869ddab28827260d3a9ab9fd9b899414f53a7c94517cf25afebb883e2638190c1b396259fead3cb3dc1f123b94ad33
SSDEEP

6144:NeQ5iCP1bcPhOYNKtZdTTitGM4GCbmwjl3Cf5d4EL:uUYNK1NM4Gfwjl3Cf5KE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4072	4292	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	rundll32.exe
Token: SeDebugPrivilege	4292	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4292	1372	rundll32.exe	92
PID 1372 wrote to memory of 4292	1372	rundll32.exe	92
PID 1372 wrote to memory of 4292	1372	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PCWPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PCWPlugin.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 720
    3⤵
    - Program crash
    PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4292 -ip 4292
1⤵
PID:1364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:4488