1f1ad9c1f639326946f39129cb9ff5015669a0a3dd9e21db07163fb48cb6b709

Analysis

max time kernel
449s
max time network
456s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
03/05/2024, 17:51

Target
$PLUGINSDIR/DotNetChecker.dll
Size 95KB
Sample240503-wfdesafa77
SHA256 8c1879e3e0855e6c22134b8cbb0986b97eb270fdddf8536be2afa18aa9344a4d
MD5 90707abc35ad1a925b128527ac974989
SHA1 47d0d433e513f0cceccb23b2522c7bc82d634691
SHA512 7cb2cce6c63210fe9abb2ba5d4e0e2a130f2c3c69ab02502d68e427a3d02b8822dbfbdc132899806f31740f44023922d3815629ab051aa01b5d829a419dd7f31
SSDEEP 1536:ak08SEy8YXsNZHPj08Ohealn/NJy1Y7WhdHNwbsW/Bcdhuh4P6a8QJ:vSEy8tj08OhB/NcHyRwhi4P67QJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	3492	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 3492	4168	rundll32.exe	80
PID 4168 wrote to memory of 3492	4168	rundll32.exe	80
PID 4168 wrote to memory of 3492	4168	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DotNetChecker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DotNetChecker.dll,#1
  2⤵
  PID:3492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 468
    3⤵
    - Program crash
    PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3492 -ip 3492
1⤵
PID:3188