4824b32e77aaa215c6497d16df9c022feddd5162fc8a3aa67a609150d91b8e92

Analysis

max time kernel
134s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 00:15

Target
$PLUGINSDIR/System.dll
Size 29KB
Sample240604-ajw6eaed2w
SHA256 f8d7c15bce6ccf0c3f230ef8e2499f179bf4fe7163fe524177ce53514eab72f3
MD5 cd9c08ef7483118c960b594afe2ac37e
SHA1 912394b4f53a6d9468c6cf58c266b1d6342df54e
SHA512 d3949e1d54019cf1bd6ad5caf9d30442c50f755f3c2afff4d97234609caa773a7820e14bf35502c98129d93e3041f1e065d719f90fc4e84058332601014a561a
SSDEEP 384:CFx8XpXIgtyMKJnoHLJ84QN+pkEkpQZfUXVPr/ceMWJ8H6pkEkhRK5RwV0/XzJdB:CFSYgty1orJ8zNjEs7x+Em+M7dK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3544	2564	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 2564	4484	rundll32.exe	81
PID 4484 wrote to memory of 2564	4484	rundll32.exe	81
PID 4484 wrote to memory of 2564	4484	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 612
    3⤵
    - Program crash
    PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2564 -ip 2564
1⤵
PID:2520