105662bc382b47efa60bba4decbaf399c954e22aacae555d8241ca614f6dcf85

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 13:42

Target

$PLUGINSDIR/cvmoxth.dll
Size

169KB
MD5

ee5cbf508fa269f316ffa4841890e2ce
SHA1

b56dd6145f41a31865a94a6d71beea7e28726ed1
SHA256

81cb9d1208b5c6e935359d2ff7a900a7517ed1f4ec956d9c0a841b2c6228763f
SHA512

0593b774044ea8e7aceeb1d036f8dea78b5ecdae3879b91afb908384ec759695a16cd28f775292dcaa16b173ebeb6265790d264c08ee03129e21be37ab8cb75c
SSDEEP

1536:GZqzTdcVOOspJnmM4JZ90Mlsu0mSi8FwBdCxMkgwyC/lkjc3u8a/CoFl9ELL+ncF:GYTd9JYWxSWKjc+8aqDX+SwezukXmMt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
672	3700	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 3700	4432	rundll32.exe	85
PID 4432 wrote to memory of 3700	4432	rundll32.exe	85
PID 4432 wrote to memory of 3700	4432	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cvmoxth.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cvmoxth.dll,#1
  2⤵
  PID:3700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 600
    3⤵
    - Program crash
    PID:672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3700 -ip 3700
1⤵
PID:840