15697c222237f22fbcc8f0fbecdad948b5698753da4a9cc0a8f2f8892c5e6e56

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 18:23

Target
$PLUGINSDIR/Convert.dll
Size 114KB
Sample240612-w1fewayejl
SHA256 2c45897153ced9e105a3e95a09fcf757bd48d0228974410f1c29977bb0660aa9
MD5 800146b096a206b799d42699344bcc41
SHA1 19d45579c0f8fda2f03c1e5f661654b381b48201
SHA512 8c214ea6a75b165f9a76a3895e8c4ebed4949ff387d4692a1a0b9e6b27d450a451d6b3645a7783d81570159df2553a6013feb2f0ae0b62c83764fbf97e8ab34f
SSDEEP 1536:qehBo8G3FQbpDXu6BbIXkCDPoxBWPa1IPHTXamfiHF6WF6HUZrvkDBO:p/JbpDXrKUtW1LKmfgFjFUUZrvOBO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	3280	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3280	3448	rundll32.exe	82
PID 3448 wrote to memory of 3280	3448	rundll32.exe	82
PID 3448 wrote to memory of 3280	3448	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Convert.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Convert.dll,#1
  2⤵
  PID:3280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 600
    3⤵
    - Program crash
    PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3280 -ip 3280
1⤵
PID:1664