072f4a30adc96c3271ed2f7ef98892efb0ca899d1f5bbc86af6b25191e562a36

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 22:33

Target
$PLUGINSDIR/ChromeI.dll
Size 617KB
Sample240508-2gvy4sde48
SHA256 1ab36e4990c1f57816e22bfdbf31c6b60d63d1d11760b8534a0e543493e69fc2
MD5 b5fb2749c737cffcdbe599b269adddf5
SHA1 6932ecc9baee317cb51340ac1a2f835bfada1d41
SHA512 e9f6dda2c9a3a6c3ee02115ba3275e0db292bca9b7b966ec80040b1d257134e817a3bd7581f003c736109b198fdd1ab77b930356f21f6405fd5c1fad1b65c000
SSDEEP 12288:nXyN7tRveGLwzMUdN/j2oE0ZBiFhjx2DZdw5Mfp:nXyNJRveGL0MUTrkjFhjx2DqMfp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	1604	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6060 wrote to memory of 1604	6060	rundll32.exe	83
PID 6060 wrote to memory of 1604	6060	rundll32.exe	83
PID 6060 wrote to memory of 1604	6060	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ChromeI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:6060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ChromeI.dll,#1
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 628
    3⤵
    - Program crash
    PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1604 -ip 1604
1⤵
PID:1804