e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 04:15

Target
$PLUGINSDIR/UAC.dll
Size 36KB
Sample240611-evdknavbpp
SHA256 07ad34100502d7aebd8c19cf6fabda31814312984ae25d26b081ddebf3926077
MD5 e6ab90ea8f9454d4a8aed70eb924bb4a
SHA1 22d7c541e93e3d5520756047e3af0324af7640e5
SHA512 23953f4163afe3a2ebadbba03e7bec5bab10c8c112ab093e3893ec11d6d4232a526014f02db995b60f63b7cc8e49f2883a6e2112092176ccfa28a45f2397527a
SSDEEP 768:4mlFrRNxK9CxHpR2fYw4G3ridSzSH7YHJ2I5:4kFrFJpR2AhGcYB5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	2460	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 2460	3932	rundll32.exe	81
PID 3932 wrote to memory of 2460	3932	rundll32.exe	81
PID 3932 wrote to memory of 2460	3932	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  PID:2460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 624
    3⤵
    - Program crash
    PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2460 -ip 2460
1⤵
PID:748

memory/2460-0-0x000000006A180000-0x000000006A190000-memory.dmp

Download