051d97d1f5d840b7c942ea453c5210571b2c27303a00ea1fa5f89f9eeb162e31

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 12:53

Target

$PLUGINSDIR/hetpbrh.dll
Size

153KB
MD5

680d69caddb35d39626cda7f06ed8de3
SHA1

85b7a9af7658ae4adb4bacf4e087c4f53b0f32e6
SHA256

c6d54c99dff947e74d01be46905cd4ea5171f0e01300caea23fc08d41e52d54a
SHA512

09ce2e5d0e7794aba376493e005c0d7fe75b37ca5366cf52c235cf986161859e867124cf64f8867d27919d5e5277fdc8c365595e75a36aef7ad4026070c0a3bf
SSDEEP

1536:Gja9ei7ByFv4gXykW/E0Zsu0IX/K0hiOzZ1DPvcm/jIXg8Xmna/YxUosCpg+X+bF:G9suHJArZ/kXg8KagjH+eG/nsxf6EL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3660	1352	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 1352	4296	rundll32.exe	82
PID 4296 wrote to memory of 1352	4296	rundll32.exe	82
PID 4296 wrote to memory of 1352	4296	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hetpbrh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hetpbrh.dll,#1
  2⤵
  PID:1352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 600
    3⤵
    - Program crash
    PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1352 -ip 1352
1⤵
PID:3448