047c6ab7a1f1b1d6d14628ad13143311eabf26d5a51ace2a3645cfa717c95797

Analysis

max time kernel
66s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 20:45

Target

$PLUGINSDIR/dmc.dll
Size

120KB
MD5

75857a33cbbaa6d6ad58ef9d7517cde5
SHA1

68dfd7ca54ab9a813a831d5c76ddafbc5ba7a0a4
SHA256

7bd3a9c95b88eca88a487345cae58a95d32888b60eeb4a6eb4c72fc65f635581
SHA512

0aafaa011c9b030023f37492bc755050b116364bf3410dfbd2236e53ce587c91abecdd2ab0e3b00307c56c5cc0f41835739d6711a341e50129ef37b85f23f9c1
SSDEEP

1536:FzIS0CGDQZ45yb1zbmuR6TcXvmpV4BNMJVx8sYse/nMBy2ZZd7yMSd:S1CpyybAUup4OJsseWy2ZZd7RSd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3116	4176	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 4176	1820	rundll32.exe	84
PID 1820 wrote to memory of 4176	1820	rundll32.exe	84
PID 1820 wrote to memory of 4176	1820	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dmc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\dmc.dll,#1
  2⤵
  PID:4176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 600
    3⤵
    - Program crash
    PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4176 -ip 4176
1⤵
PID:5012