0bbf49dd0df354467d21b219a536d845f62a71ae891dbef7510708f97f82dfc8

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2024 06:03

Target

$PLUGINSDIR/EmbedWeb.dll
Size

22KB
MD5

2312a7ac514325c2f1efc6f4cfdecd61
SHA1

7d12b05a867ec6d40f174c797dc3b691e6fa2408
SHA256

fb9cc3565cf89cf862665003b329be514e1fbcdef83a9ed994238800156de983
SHA512

187ef38f755f1e30524e3d60d1d4188160b654f2430c0246e160d9e8971d565986010a47a9ef3c8ca99eae7e0993c8be0b2cb93345cc6f30b179206f57e54b9c
SSDEEP

384:PoH8ERst6OBXZEHM+2B2seRigkVlLejQzMsHHO/2jos27WYtUUUUUUUUUUUUUJ7k:PJG4LBc2B2NRpKlPMsHHO/2onUUUUUUU

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1044	4448	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 4448	880	rundll32.exe	82
PID 880 wrote to memory of 4448	880	rundll32.exe	82
PID 880 wrote to memory of 4448	880	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\EmbedWeb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\EmbedWeb.dll,#1
  2⤵
  PID:4448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 612
    3⤵
    - Program crash
    PID:1044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4448 -ip 4448
1⤵
PID:4084