602baab3e174a495e5606300d166dc2fe54e903d93b382759859d451f9dd1c0e

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 08:33

Target
$PLUGINSDIR/System.dll
Size 11KB
Sample240603-kf28csae42
SHA256 93a8e95708882e56250ae55aef93417333b2dbe7ea99590abed34cdca2227e61
MD5 c51fc979c1c3e17bece7bd194aeb6ea2
SHA1 9a5d000d6393f2980062b4cc6e8f543493b1be8f
SHA512 716cdeb890307ff42901464dd24aa94e29415ef20d4e975c2733e34330fdf85edfd4ad9e00878edbe98921deebe44153279cb95acb309c5e1812026716dcdc4e
SSDEEP 192:sfer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4SyYXe:sw7Xws4FVWig86/5eCBqSyYXe
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2968	856	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 856	4592	rundll32.exe	83
PID 4592 wrote to memory of 856	4592	rundll32.exe	83
PID 4592 wrote to memory of 856	4592	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 856 -s 612
    3⤵
    - Program crash
    PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 856 -ip 856
1⤵
PID:1472