0a6180189e4f5911e0bdf60d52fa85a31cf1f6a55625b3bb17d066e07a1a4705

Analysis

max time kernel
136s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 00:20

Target

$PLUGINSDIR/SaveInExe.dll
Size

112KB
MD5

19fa9ebf6249ad9859e3e8e8801a8bdd
SHA1

68961532b00b21140d86686d2f3236d68bb397c6
SHA256

c65fee48577525063f7acd960cd0869bb5e425968b2a8a94d130a9d7fb5a3ba2
SHA512

1d9d9d7f247cb94e238c2accfa34e317a72a9456c840fb972c638200f038629cb937e7fcb162bf39dbe9b47b28c19440b4772aebd18938e487eeec9b41420af5
SSDEEP

1536:CGM6oK9K7ELycM1/40zv4ThZkKiom9EnwGVGi2ICrFodRUax/tj9XSz0qFJSJ:9M61vycOzzKjmVB9redRUwV07nS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2724 3896 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2724	3896	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3564 wrote to memory of 3896	3564	rundll32.exe	rundll32.exe
PID 3564 wrote to memory of 3896	3564	rundll32.exe	rundll32.exe
PID 3564 wrote to memory of 3896	3564	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SaveInExe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3564

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SaveInExe.dll,#1
2⤵
PID:3896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 600
3⤵
- Program crash
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3896 -ip 3896
1⤵
PID:2128