2a3f928955893e6810408be597a7b15008d5b1999d1b70e3f7a73fcf8cddde58

Analysis

max time kernel
92s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 19:39

Target

$PLUGINSDIR/ButtonEvent.dll
Size

52KB
MD5

da85f0f06cda668c88c1af4553358902
SHA1

7d95f6a00bcb30566b78293f7139f9eae1c788ab
SHA256

a0746336fc1a8277a4af1758b39bc312ebf40c91ddad95aef40ec98b7699117d
SHA512

0563e4d54a83d657406142c1a9837d03e16a48c5eae28ad3935f69a06ebd7d8d91364c97c11b788b071e05c7a87f840364c160b70dd2666b33e73aad3a7fc027
SSDEEP

384:l6OzrBF/QTE9QfEx4tibP6tnYfb7IyoD8719R+wNNxyPvDeR938lUL7huc2ODjIT:cg/QTaKKGnYD75NNw3DfqNtI1tLX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
976	4904	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4904	4264	rundll32.exe	83
PID 4264 wrote to memory of 4904	4264	rundll32.exe	83
PID 4264 wrote to memory of 4904	4264	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ButtonEvent.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ButtonEvent.dll,#1
  2⤵
  PID:4904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 600
    3⤵
    - Program crash
    PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4904 -ip 4904
1⤵
PID:3956