dbdc4bbf70c2c98f63488758b63677bee47f87423efddab8b550b386a946355f

Analysis

max time kernel
66s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 17:23

Target

$PLUGINSDIR/ApplicationID.dll
Size

52KB
MD5

b5d63240d145cef5a226a757bcb9cfa4
SHA1

043e7d43b74a71bb1f7ea7a8cccf2150879babe8
SHA256

096e40b3fd5803f323660b2687946d4d6ad004e84b27ab67d4f60707358ee375
SHA512

c67f4bebdb906cb30b9cbac02a3ca3d06d74d0a4d9f580873242059a7102b278dba2af7b4bbcb728b3dcc40396d56e5bc9aa68485b3657465e173a54666fa1ae
SSDEEP

384:Gubd5EUwI12n3t7LgbpbnGRemovGQLRQnM7zvnPjRFgiNrTU77eu7Ix1xPW+hLWD:/bd5EUMtgbnmMG0vvPZ5ki6YPW+hTL

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4880 1204 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4880	1204	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4944 wrote to memory of 1204	4944	rundll32.exe	rundll32.exe
PID 4944 wrote to memory of 1204	4944	rundll32.exe	rundll32.exe
PID 4944 wrote to memory of 1204	4944	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ApplicationID.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ApplicationID.dll,#1
  2⤵
  PID:1204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 612
    3⤵
    - Program crash
    PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1204 -ip 1204
1⤵
PID:3856