bc4101cb2be2bc8fedb16c82b4c4dc808176f519f9c2c8012c6e18b4b35d932d

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 07:54

Target

ExtensionManager.dll
Size

121KB
MD5

b1d3e1679bd267facd40604edcde2f5b
SHA1

08c1ad07bb1e5133a7489fe9a777dd1d1d980bfc
SHA256

361fd06e5c3acabb49e21906f83579d5fab59266210b365909fba1f478e8f6b8
SHA512

2c684d29e35b28e91cd1816179e95f08cb931049a76182a7d45561c23a3f0b4dd7f7398c142f7db6dcb82452432544c21ec6749d72f2e011504563795c187f0b
SSDEEP

1536:2GjKcE8Nbu2NtzibjUzcez/EC6PWSd2g3Il+0+Yvpc96YsWjcd9FdPDQJyOI:zK+rpj/WlFSV+6Q6H9FdPDQJyOI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
384	924	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 924	848	rundll32.exe	84
PID 848 wrote to memory of 924	848	rundll32.exe	84
PID 848 wrote to memory of 924	848	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExtensionManager.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ExtensionManager.dll,#1
  2⤵
  PID:924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 924 -s 600
    3⤵
    - Program crash
    PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 924 -ip 924
1⤵
PID:4272