4824b32e77aaa215c6497d16df9c022feddd5162fc8a3aa67a609150d91b8e92

Analysis

max time kernel
128s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:15

Target
$PLUGINSDIR/FileInfo.dll
Size 121KB
Sample240604-ajw6eaed2w
SHA256 8f7d75e4ea90962c8438785b8f32b0069d0402f8befed741a3a98391e478b090
MD5 80fe0f9702d94bb88515f42bf8a4ed34
SHA1 7af08fa14927a2f5ec7121c5adb7bf98514696d9
SHA512 387123c2577e44db41d297c5dc30848d6a733fd233798de642f831b81aada5bb2bd0fa334b3a599468330eeb66efa9655a4fb5c8797b1cfc13a87d9b5d29a696
SSDEEP 1536:UPbjnSKdEa7gtJzYAvqIe6zq204iuX+RJmrcpOzsWjcdGf+mdJuMczQ//5h:UP9pMvRvnRq2NzqO86+mdJuMczQv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	4780	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 4780	2644	rundll32.exe	83
PID 2644 wrote to memory of 4780	2644	rundll32.exe	83
PID 2644 wrote to memory of 4780	2644	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 624
    3⤵
    - Program crash
    PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4780 -ip 4780
1⤵
PID:2604