20293f2776633514809eaa36fbce8b15df345318d138810dc3c152bc2f6359ed

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 06:39

Target
$PLUGINSDIR/kmxoeuy.dll
Size 170KB
Sample240613-hemp6ssaml
SHA256 30a89499e7e11968a6cd0fbd40e9b50d10fb8d66a0715aaec651a552039c702f
MD5 15633cb17a79403bd79062ddb5e8a027
SHA1 bccb2e48d09ccd74b729b346ab69e00eacb6bb3d
SHA512 643855e40317f601e507ecb6b6793187e52cb77b20d81b61208d156a8841171dd7cf2d1bc59bbaceab8a143cdad18677dd672886ef372e6add9282fc742bba08
SSDEEP 3072:GU5H/7GWh0TUmwiTTLy2Q689+xw2zfMSUj:z5HzGFDTLy2Q/7eZU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4796	2860	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 2860	1008	rundll32.exe	82
PID 1008 wrote to memory of 2860	1008	rundll32.exe	82
PID 1008 wrote to memory of 2860	1008	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kmxoeuy.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\kmxoeuy.dll,#1
  2⤵
  PID:2860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 600
    3⤵
    - Program crash
    PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2860 -ip 2860
1⤵
PID:3988