1684c2d7efc42505f47e901f5293ecf3c181b06bad66760ca8988b7a26af697f

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 11:49

Target

$PLUGINSDIR/moo.dll
Size

108KB
MD5

076a3050150c1887d9a5ef76762ff4a4
SHA1

225adac93a9de5af6ca5646cdaf66c69c821dee4
SHA256

72d94ff0e7b385b21bb5f103f055602b67e3e805408d81859fe5ec93a1dc2c2b
SHA512

66be5077dc0380232f5033f101447c08ae0f8c9b5768b2c3a5ecca9b33d4d3932dc4d5fe4167021736884111ef57f1839bd3525ba04968917591f71ee65ac0c8
SSDEEP

1536:nCBz0TBtjpSkYTCjD1j1Uu8Myf58ic19Kniot2hpZi3FVzBMEwH2qiwALXzPi8S:nCBz0PplYK7iBKKIm3vzLXzq8S

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3808	1884	WerFault.exe	92

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1884	2236	rundll32.exe	92
PID 2236 wrote to memory of 1884	2236	rundll32.exe	92
PID 2236 wrote to memory of 1884	2236	rundll32.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\moo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\moo.dll,#1
  2⤵
  PID:1884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 600
    3⤵
    - Program crash
    PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1884 -ip 1884
1⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:2072