5ea92cd1af34a0faf1293afa648e3e1e610d89deaf663b4a75a38fbf03ba99dc

Analysis

max time kernel
139s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:19

Target

$PLUGINSDIR/FileInfo.dll
Size

720KB
MD5

a3226dd87d13bb425e1a9d180eed3018
SHA1

6b247e0ed12ef17eff962aaeeb8547c5288e0904
SHA256

83c0b802b0c1f5fb2eefb428296b8424f7cd724f9b51384220d20f9ca34d842f
SHA512

d6d90d9ea051eef9a3d41e24929a0ebd577562fabd5ad82bef3107348022fec05921de7c76c0961ab0a6ef7609f9c6c5c6b3372cf23b52dbe90c1b666223a73e
SSDEEP

12288:KyverRy6NIkxFMu+4dC61me3qwwvXHJv1+w/ECsFvScB0MG8R5Tfb+2mPousVQO:Kyve9ywx3V739wBv1+wudS+0M7rTfS2n

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2452 2352 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2452	2352	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 2352	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2352	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2352	2040	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
2⤵
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 632
3⤵
- Program crash
PID:2452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2352 -ip 2352
1⤵
PID:324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3980,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
1⤵
PID:3308