7bef645ef38227df5ceec2ea4cf7903f9eb8e3266bc15885a8b03207eaf35aee

Analysis

max time kernel
137s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 16:53

Target

$PLUGINSDIR/AccessControl.dll
Size

15KB
MD5

f894e7068ee5f5b4489d7acdde7112c9
SHA1

79ec857791ad4ac76673b05e6fc44e55315424ef
SHA256

3948484bc6a6e8652c2220be411cdcabab73eab46578faca8c0bd01d3ea290ab
SHA512

e85b2bdc27b9721425bb03393e8aad897647053c77d7862ea541e03dc896173af6eaaf182514d46464d560d15c6b9d4652690885426ac1c68e2b9dd8d632e816
SSDEEP

192:VUmFdGZ2ESi0SGlIO1yn3B+boYt0/SNFdTmUJJimGf/5b2xlUqyWWKCi1wlLjck2:FdGZ2ESnTqkddTm43saIvy

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4524	2732	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2732	4712	rundll32.exe	83
PID 4712 wrote to memory of 2732	4712	rundll32.exe	83
PID 4712 wrote to memory of 2732	4712	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AccessControl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AccessControl.dll,#1
  2⤵
  PID:2732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 612
    3⤵
    - Program crash
    PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2732 -ip 2732
1⤵
PID:4468