29bf1bd7dfb0fe799a29bb9162ff3c873857fb7c354843d7d022e11a9c842cd5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 21:32

Target
$PLUGINSDIR/Processes_2015_02_11_2_1.dll
Size 56KB
Sample240521-1dl2csbb63
SHA256 d8d618d75d0c01c39bfc0827d1414c2aeed299cf541d3387322d0fd91bfd06a7
MD5 0dc4361cc10bf4609baae53cca018a58
SHA1 b69e3ddb534f4ad10b6a532c9125b372ac73abc9
SHA512 1745d39ebcdb898fa752e2015356131e53bc064e79dad04c9b2917aa237088110291d8ca813e67ea71aa6c03614194a9c52285bfe7f18abe5c8b862b8520c293
SSDEEP 1536:J0wO3mVw8a7HzpyHrHhQl27ssSsVK5bamG:f6UimSsVK5mf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3244	4608	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4608	2772	rundll32.exe	83
PID 2772 wrote to memory of 4608	2772	rundll32.exe	83
PID 2772 wrote to memory of 4608	2772	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Processes_2015_02_11_2_1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Processes_2015_02_11_2_1.dll,#1
  2⤵
  PID:4608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 604
    3⤵
    - Program crash
    PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4608 -ip 4608
1⤵
PID:1420