165f409d83fa740b9aee823cba0d5842e1362e256bd8d046fba139f0b4dc7290

Analysis

max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 08:59

Target

$PLUGINSDIR/System.dll
Size

23KB
MD5

a64b9c1f10a5434738f6efec8a1399c9
SHA1

a66e15e4125cb358c1e1998ce393f9660e4f65bb
SHA256

2d863a8cebd864ce51052984bd2031d37c9b022bb80c80ec0b1ca382160ae57b
SHA512

53510079aff46a1b98ff7e0055288af2dce8ec3224fa5869fca4c29b33b26bad7bddecde0ded08a07e162d1bfbcca1120c0717a6156967f944567eeb99f942ee
SSDEEP

384:AAQ5GjarYFU76ffyEIPb9p206QrHwIl8ToknCLJy4k9KyFkKCKOin/aY+:A2XixPbPD6gQikUywWkK9/aY+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4420	3652	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3652	1180	rundll32.exe	81
PID 1180 wrote to memory of 3652	1180	rundll32.exe	81
PID 1180 wrote to memory of 3652	1180	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:3652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 612
    3⤵
    - Program crash
    PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3652 -ip 3652
1⤵
PID:3916

memory/3652-0-0x000000006E3C0000-0x000000006E3CD000-memory.dmp

Filesize
52KB

Download