0d5def3720993c7ff853209226c0becaee1a367ee2d69dae8cf9cb951602b4e6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 00:37

Target

$PLUGINSDIR/reportsetup.dll
Size

309KB
MD5

52c3b9ac0484ece3b524a9526272f88e
SHA1

c07268de6a13290acbf58ec5ef75e2468533d791
SHA256

210876c0ff70ffaa88a05f9ef794a96136549f4168e940e256fb4ac85b0fff71
SHA512

da7710404e5630509eeaf9e318e2a4a2d9c4f269aee6cdce5d2a8f128094e7c92940312fda9913f5c44dce5159b59159f40137ddb2e7975e450f30c6a7b24f47
SSDEEP

6144:9TTPaNT41SBzliGz6WXKzoOCEIMzjKTBR2Z4kgg6D/Uuc:NrmT4uxiGz6WazojEfnKT/2Z4nD/Uuc

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2560 4600 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2560	4600	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 568 wrote to memory of 4600	568	rundll32.exe	rundll32.exe
PID 568 wrote to memory of 4600	568	rundll32.exe	rundll32.exe
PID 568 wrote to memory of 4600	568	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\reportsetup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\reportsetup.dll,#1
2⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 640
3⤵
- Program crash
PID:2560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4600 -ip 4600
1⤵
PID:4924