4d75f699e97613c70c18279a2faf37026ed2500a0b4af45b9460da0115903b36

Analysis

max time kernel
109s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 14:46

Target

$PLUGINSDIR/cfcnylv.dll
Size

153KB
MD5

01bce109d8a462e2ae84ec617287867c
SHA1

717f97fb5e21ae916ab26b08a65d66e51b0bc92c
SHA256

d5f93c4eb052d9063499f0d62f794b19dcd966287e91c118117b44106a815df6
SHA512

2d1946eee1cb61c60467fa34c5a4fbfeff49e509e19ddf40510fe43263cf441bd53b6adafa1a0591ad9c15af7b388b41a242168747bc39f2275313465e500a48
SSDEEP

3072:G3Z3VTVBYqvus53WhuXniHp8/JKv+oG//sRVOxHQ:qZ3Rl3yHp8Mv9GRxHQ

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2368	3628	WerFault.exe	90
2160	3628	WerFault.exe	90

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 3628	2296	rundll32.exe	90
PID 2296 wrote to memory of 3628	2296	rundll32.exe	90
PID 2296 wrote to memory of 3628	2296	rundll32.exe	90
PID 3628 wrote to memory of 2368	3628	rundll32.exe	95
PID 3628 wrote to memory of 2368	3628	rundll32.exe	95
PID 3628 wrote to memory of 2368	3628	rundll32.exe	95

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cfcnylv.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cfcnylv.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 600
    3⤵
    - Program crash
    PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 600
    3⤵
    - Program crash
    PID:2160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3628 -ip 3628
1⤵
PID:4728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4832 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:2020