8f3cfcedaf845387e4f7d07c77db62ad6f3c6856995ed8e0d1cdcecef17e0bbc

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 09:04

Target

$PLUGINSDIR/DotNetChecker.dll
Size

83KB
MD5

e02ed575cffbc793af912c5541c7ffb3
SHA1

1fd8f5ed9417b3804c1fbd18340eba4d09326f60
SHA256

45e15d319084e019d4db5a3081533ba8c032308cf35384abf8b65ddbac6c5f9d
SHA512

76804c9df7f97dc50ff375d1f1d972f2d20b57e2c543986a47de61fc2a0ec87225bc22d69ef31a37a12ecec46e477595184a964587ef469d6b0698cd71ebb5f8
SSDEEP

1536:bg5jFZGXKkwO1V2+XDlM7IVNBNN4GS0CPrAm0dgKQUDs0OsWPIcdngsi9eJ:byCC7iN4rrPhKQngsi9eJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3500	5108	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 5108	220	rundll32.exe	84
PID 220 wrote to memory of 5108	220	rundll32.exe	84
PID 220 wrote to memory of 5108	220	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DotNetChecker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DotNetChecker.dll,#1
  2⤵
  PID:5108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 612
    3⤵
    - Program crash
    PID:3500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5108 -ip 5108
1⤵
PID:1428