9d6ed95597857927f0e7e6eb1495c4ec10fa74aced7efbc9199c4392be7585a6

Analysis

max time kernel
129s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:57

Target

$PLUGINSDIR/inetc.dll
Size

152KB
MD5

f33493944b33bc82194d64fe4ed4057c
SHA1

ee1905acdacb31398c5bddb80562e4850b2665a7
SHA256

09790036c31481a93d0ec9601fbd7a0c70ce70aa020dbeaf4e10e4b12042679d
SHA512

9e12febf0e66a0a269135fea061386180f251bb767943f8aa3fba8398fd54b3b4de28a1a781daafb2300b61216e2d597756bf403a608f0a37bfd8749a288fad4
SSDEEP

1536:1Dc5IbWa6UzkT64jD9/Z2gi58LiKJoXdN7EC3/dL7HvteEhxsp+BhQzxcVaevh:hOIiT3j5PLilAq36+BhQzxcoeJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3616 2912 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3616	2912	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4680 wrote to memory of 2912	4680	rundll32.exe	rundll32.exe
PID 4680 wrote to memory of 2912	4680	rundll32.exe	rundll32.exe
PID 4680 wrote to memory of 2912	4680	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4680

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
2⤵
PID:2912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 624
3⤵
- Program crash
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2912 -ip 2912
1⤵
PID:3092