27694908dbdcf9b68fe26c65140c22da7068c2ebd154db13d2eb1571f9153ede

Analysis

max time kernel
136s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 21:15

Target

$PLUGINSDIR/PictureWindow.dll
Size

45KB
MD5

7c9499d5c444fde76e2dc05023c54925
SHA1

6c1e97042638fa44ecfad286a0bfc45f8133f4f2
SHA256

1449b163e6f5a9723d27ddfdfa9745ecdd90eafae7315981ce0842906cf3f1e9
SHA512

b75093db490cfa0a5a7a04c67f194bc79ea493625f98c99ccb5d0b703ac42035e5ce4b8159381e1852c6d27882ffa0ac46d897983322011a6322c81e96f0477b
SSDEEP

384:aSbkWAd6jiaQid8iJqnTkvYsNZ9QdTRsFw3TzW8YJLu18TbCyK:aAkAiaQid8iJ1Q8Z9Q0FqziLWQbCz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	624	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 624	4616	rundll32.exe	83
PID 4616 wrote to memory of 624	4616	rundll32.exe	83
PID 4616 wrote to memory of 624	4616	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PictureWindow.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PictureWindow.dll,#1
  2⤵
  PID:624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 644
    3⤵
    - Program crash
    PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 624 -ip 624
1⤵
PID:2500