18bc0dce0f3bbe69c692f56b3b0a8f4040d0299b0aec1aa523e8ff424fd4549d

Analysis

max time kernel
146s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
09/05/2024, 21:18

Target

$PLUGINSDIR/log.dll
Size

356KB
MD5

bbfb1bf8ce713934f004720034d23542
SHA1

d170db74d8b8d994e495c75a1b75f9503fad4a40
SHA256

f3a1fb98d12393e24cc667c6c0261884e961c3ea3e79254a3a68d8d9cf022ab8
SHA512

74cecfde7670da28777a02a861fc65cbb9c8d8efadeaf8cbf85bbfe2c6c7f92987b27363824ece47c0c6ff20a1d01006a2b5adc23825bc55f9d61c097484c703
SSDEEP

6144:kThI7H1V5uX38p22TyHFm4VoYdbPVTRMz8VTfnjB6H6CBvENXL3gvflTJxUf:kuH1Von8ym4VQz8VbnjB6CaxUf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1424	3116	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3116	3668	rundll32.exe	77
PID 3668 wrote to memory of 3116	3668	rundll32.exe	77
PID 3668 wrote to memory of 3116	3668	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\log.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\log.dll,#1
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 532
    3⤵
    - Program crash
    PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3116 -ip 3116
1⤵
PID:1436