15fa1ce6749d5ad541e7511dd8b3ff93da48accbe073f078ec0ead70d8de94c1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:15

Target

$PLUGINSDIR/System.dll
Size

23KB
MD5

a64b9c1f10a5434738f6efec8a1399c9
SHA1

a66e15e4125cb358c1e1998ce393f9660e4f65bb
SHA256

2d863a8cebd864ce51052984bd2031d37c9b022bb80c80ec0b1ca382160ae57b
SHA512

53510079aff46a1b98ff7e0055288af2dce8ec3224fa5869fca4c29b33b26bad7bddecde0ded08a07e162d1bfbcca1120c0717a6156967f944567eeb99f942ee
SSDEEP

384:AAQ5GjarYFU76ffyEIPb9p206QrHwIl8ToknCLJy4k9KyFkKCKOin/aY+:A2XixPbPD6gQikUywWkK9/aY+

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2376 1096 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2376	1096	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3460 wrote to memory of 1096	3460	rundll32.exe	rundll32.exe
PID 3460 wrote to memory of 1096	3460	rundll32.exe	rundll32.exe
PID 3460 wrote to memory of 1096	3460	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3460

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
2⤵
PID:1096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 612
3⤵
- Program crash
PID:2376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1096 -ip 1096
1⤵
PID:1516

memory/1096-0-0x000000006E3C0000-0x000000006E3CD000-memory.dmp

Filesize
52KB

Download