b1c086728237f60b8fc6b97c8fcace59659aeb1424d8ad71e1bf797555f96828

Analysis

max time kernel
136s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 00:37

Target

$PLUGINSDIR/you.dll
Size

121KB
MD5

591df37b3c00d9596dd1bc5cc75c9487
SHA1

3f26ba2e9557cacecfa4a40843028de7684bf9f9
SHA256

58bc550789f17246a712a481b3f8b423fad7f56f552f4928cdb18806931d8b1b
SHA512

88e429bde9ce0ef2fdd5a8e9a65ce3a71e1e8e689d5296968398a278d35358075cb727f1f699a24d00cf91f4217f752d422dc90154179650ffa9c52bda98b0f2
SSDEEP

1536:mquMVNz381bgA6O9I1UOdOZhFyug6iXnnqkwMU8CG/whmPWznTcY8Yl7JxcHjd:mqu08eApgUU8WqiXKmFY5Tch

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	4680	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 4680	2472	rundll32.exe	83
PID 2472 wrote to memory of 4680	2472	rundll32.exe	83
PID 2472 wrote to memory of 4680	2472	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\you.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\you.dll,#1
  2⤵
  PID:4680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 600
    3⤵
    - Program crash
    PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4680 -ip 4680
1⤵
PID:1252