dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
51s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 04:35

Target
$PLUGINSDIR/GetSupplyId.dll
Size 108KB
Sample240617-e7s6waydqq
SHA256 e2ab61f602396cb75ff0745cf08c09ba6588163b34b9af93503e994df76a697e
MD5 f1a3e3d2552723cf46f1e9aaa4741877
SHA1 560603c05014691982a18ca3fa4eb9a1670552a4
SHA512 88c0c24ca167c15cb788bf09d777e5957337b34cfa6af7329f889ea7de1a454f5fb3570c053f0f47ed79131df1a1749e32bbd1f48462da7b6bde19af093d290a
SSDEEP 1536:AYW6vFwXaryVIpAyg2kJazPK3SPw+YFNtVy:jWGUdIipxm8NtV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1648	1192	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 1192	4908	rundll32.exe	80
PID 4908 wrote to memory of 1192	4908	rundll32.exe	80
PID 4908 wrote to memory of 1192	4908	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GetSupplyId.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GetSupplyId.dll,#1
  2⤵
  PID:1192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 572
    3⤵
    - Program crash
    PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1192 -ip 1192
1⤵
PID:3872