62785bfab54aff8b4099c82fb0e47513803f90b424fe7aa60c4c3130e43094cd

Analysis

max time kernel
140s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 06:05

Target

$PLUGINSDIR/xml.dll
Size

182KB
MD5

ebce8f5e440e0be57665e1e58dfb7425
SHA1

573dc1abd2b03512f390f569058fd2cf1d02ce91
SHA256

d1aaacc0aaf477b6b9f084697adcb444fc2333b32e8d99d224dca89516e762a7
SHA512

4786c9124973b6543d7291047d4c4a06c05282a3766212dbd3b8ce9b9560afddca20c491f791db2258c14ab767d5d3f480daa4706492949eae2ceb4a35aaef85
SSDEEP

3072:Slq7cnzRLdesQbC7ojAqmiGxKUQ8hJgWWHFbit4Gs43YSIFWt:SlYcnzRL8BbwojAzRRQ8hJxahif5wE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4804	4904	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 4904	1408	rundll32.exe	90
PID 1408 wrote to memory of 4904	1408	rundll32.exe	90
PID 1408 wrote to memory of 4904	1408	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1
  2⤵
  PID:4904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 600
    3⤵
    - Program crash
    PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4904 -ip 4904
1⤵
PID:1744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3672 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4180