5a05f7c50928cffc850b084067bce03ab042038a12fe8e8c4c5b183cef4420de

Analysis

max time kernel
130s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 16:38

Target

$PLUGINSDIR/System.dll
Size

12KB
MD5

e227391c7ff576135eac4871e78ebe2d
SHA1

85d4bdbb79bdc47095ca35ed2141b2e64d029218
SHA256

edf12a3040cff0d801a86c02313d6605b41d766807f3dcb261754cf01b4e14b9
SHA512

06f1b65dd980c6aac17518faf34d200453fedf893efa01bfc71128ccb1a70abcd7165f581c9789caf80776fac313a4e754df7b58f7467930a666de37b55396a6
SSDEEP

192:asA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:hR7SrtTv53tdtTgwF4SQbGPX36wJMw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	1648	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1648	1688	rundll32.exe	82
PID 1688 wrote to memory of 1648	1688	rundll32.exe	82
PID 1688 wrote to memory of 1648	1688	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:1648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 620
    3⤵
    - Program crash
    PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1648 -ip 1648
1⤵
PID:8