27694908dbdcf9b68fe26c65140c22da7068c2ebd154db13d2eb1571f9153ede

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 21:15

Target

$PLUGINSDIR/CommonFuncDll.dll
Size

201KB
MD5

d62a1421c26f59015ede0f10638a7b1a
SHA1

bfbd19a256fc7f79b8089eacf22ff364116ede17
SHA256

ec88e41350b16456d299909040680d2a291f29da6f6ff8e8c5ef3bbfc355f45a
SHA512

9928ba693ddac2355399b3efcb4becef8fd6ef7cac7556d0bdc9d13fb4780f8246256a0df0c7406c05e090d718f92997f0b072162d9429b6a3021f81fe60f7cd
SSDEEP

3072:CyAyMR2mQrxPozIKljLkCKCoZyqf8xMnhTHL0pgDrtE2fo1h0My:C8O2zrxPoIgLLpqExOhTApgDrtxw16

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4884	4328	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 4328	856	rundll32.exe	82
PID 856 wrote to memory of 4328	856	rundll32.exe	82
PID 856 wrote to memory of 4328	856	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CommonFuncDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CommonFuncDll.dll,#1
  2⤵
  PID:4328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 704
    3⤵
    - Program crash
    PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4328 -ip 4328
1⤵
PID:1052