492df6f4fc4b890b577cce8dc7b96746f5b78d556946343ab85faca9174a6761

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 13:59

Target

$PLUGINSDIR/UAC.dll
Size

16KB
MD5

0d422e0c03a7d9428c6c02175d7dc9f8
SHA1

5e13d49521cfbbe52cd74de8e1682789f0268969
SHA256

9f47ec720d74e538bbc8d0c1118efcbc52e52050dbe98c27029fc35329996f7c
SHA512

2edf47b24c4201e082841824d6ad9047a06e9a877d799e87befaf5d54179c924849d2e608cf9f60a1480828edcd98e19f3d139d19bdb4b96ee4939fe58bf0887
SSDEEP

192:GqzPEcSUa9KbONtrHf9IyMx7A+iCooYJlgNkGcioGZ5vQhjN9ZmyCaMAWkah+2oD:5rEcSUuv4xkOooPXci/ShZKaMAWk5ys

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2616	1892	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 1892	4824	rundll32.exe	86
PID 4824 wrote to memory of 1892	4824	rundll32.exe	86
PID 4824 wrote to memory of 1892	4824	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 624
    3⤵
    - Program crash
    PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1892 -ip 1892
1⤵
PID:640