1088c38976f5a7f857f502deb9e0bba7faeb962df17555a212abb4341774d4a7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:24

Target

$PLUGINSDIR/tmp5iwdhe.dll
Size

2.3MB
MD5

64506fff60af135a6c7ac270ee576683
SHA1

5f6173fa4731333913c9e3a356c2ac3e7a7a9201
SHA256

47b57964ebce3279e2c9f7491c00194a3c114a5cb4130bda0fd557e6c128b21c
SHA512

1f4f1e91a39810c293a929dcaaaf4aca9575f4bcf7055511f58e328e789aad5b4aef2a4fd8cb2addd59b83252c6b71fd2a52eb61b22590ee7218a548a70ea5d6
SSDEEP

49152:3LvJvQvSvUvDvMv2vXvXv0vXvIvbv6vRv5v4WjOxu7:7vJvQvSvUvDvMv2vXvXv0vXvIvbv6vRT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1280 1836 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1280	1836	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4628 wrote to memory of 1836	4628	rundll32.exe	rundll32.exe
PID 4628 wrote to memory of 1836	4628	rundll32.exe	rundll32.exe
PID 4628 wrote to memory of 1836	4628	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tmp5iwdhe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4628

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tmp5iwdhe.dll,#1
2⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 720
3⤵
- Program crash
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1836 -ip 1836
1⤵
PID:2344

memory/1836-1-0x0000000002D30000-0x0000000002E87000-memory.dmp

Filesize
1.3MB

Download