aa8b2bdf7aea5d39df6921fcff7da3c813ee4c52b0773d4e82089e1f1b724d2d

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:19

Target

$PLUGINSDIR/FileInfo.dll
Size

720KB
MD5

a3226dd87d13bb425e1a9d180eed3018
SHA1

6b247e0ed12ef17eff962aaeeb8547c5288e0904
SHA256

83c0b802b0c1f5fb2eefb428296b8424f7cd724f9b51384220d20f9ca34d842f
SHA512

d6d90d9ea051eef9a3d41e24929a0ebd577562fabd5ad82bef3107348022fec05921de7c76c0961ab0a6ef7609f9c6c5c6b3372cf23b52dbe90c1b666223a73e
SSDEEP

12288:KyverRy6NIkxFMu+4dC61me3qwwvXHJv1+w/ECsFvScB0MG8R5Tfb+2mPousVQO:Kyve9ywx3V739wBv1+wudS+0M7rTfS2n

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2192 4592 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2192	4592	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4896 wrote to memory of 4592	4896	rundll32.exe	rundll32.exe
PID 4896 wrote to memory of 4592	4896	rundll32.exe	rundll32.exe
PID 4896 wrote to memory of 4592	4896	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4896

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
2⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 632
3⤵
- Program crash
PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4592 -ip 4592
1⤵
PID:4068