0a6180189e4f5911e0bdf60d52fa85a31cf1f6a55625b3bb17d066e07a1a4705

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:20

Target

$PLUGINSDIR/Registry.dll
Size

93KB
MD5

33ca3018c1ba8cab6b1acf0e79103618
SHA1

e31f4c54bd9d76eb68f5e0ef08a99f241e981947
SHA256

8078be74f4cd4b6aeb4fb3d5d0d467d4ca32bdb18ea48ce2ab07dc61ab7484c7
SHA512

f0fd4fce7dc9d77ccfd8c692db59e5e3e90f54887947ffba8dee4452403746ecfa2281b44380c4b3f00c6c78cd6babc12c43805e55064d502e012f3f33c3579f
SSDEEP

1536:UdxbSzGuoHghElK3/O2yLvPmWwUgSc/Ze+tGYNJk1teOtAbltg:UdxbSzGuR53/bKeFUOltGYNJ0teOtAbI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

224 4400 WerFault.exe rundll32.exe

pid	pid_target	process	target process
224	4400	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4356 wrote to memory of 4400	4356	rundll32.exe	rundll32.exe
PID 4356 wrote to memory of 4400	4356	rundll32.exe	rundll32.exe
PID 4356 wrote to memory of 4400	4356	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Registry.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4356

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Registry.dll,#1
2⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 612
3⤵
- Program crash
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4400 -ip 4400
1⤵
PID:3112