dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
50s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 04:35

Target
$PLUGINSDIR/Report.dll
Size 98KB
Sample240617-e7s6waydqq
SHA256 1d697cba0b02f54a5fb5759f0b5feca39dd272a35a8621b14624e9067d78c2db
MD5 5767863541cde6995690b2a00bb32431
SHA1 2960376d507ccee1806fee50453e034486daedf3
SHA512 4cd00cbe833de19fddca291b30c965b8380dcd457dab553008722f92fe4841f2e85a71c09899be63ab42ab48d6621ab4dd88fad530907cd9c7cb993493a0e0cb
SSDEEP 1536:UjR4Zllo5PYpKTQWxrDXQewk0BtXR3nhDtz2g:UjuZjo5PYpKHV0bXRBtz2g
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2480	844	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 844	1336	rundll32.exe	83
PID 1336 wrote to memory of 844	1336	rundll32.exe	83
PID 1336 wrote to memory of 844	1336	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Report.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Report.dll,#1
  2⤵
  PID:844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 600
    3⤵
    - Program crash
    PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 844 -ip 844
1⤵
PID:1688