57e4ae8a8f52008ba09062a0888783c8d622c94c7fddf15db758f45b106e917a

Analysis

max time kernel
51s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 02:41

Target

plugins/PriamNPAPI.dll
Size

55KB
MD5

0912d0ccfd6cbefe2bd6b4473d006771
SHA1

ed9dad52f3ae71472b810bfa71159d448cf3e68d
SHA256

c8493605aae1563e133b20543d02aa421f477b9a955fd547f7d2c7cdc1dd787d
SHA512

dfbe41244bfc321a9efa717924bc8cd527d422eded98c4bd0c3c8391a0bdb8619571f2c757a825cadd145ce07b235714625326fc4c16ccaef67d71a576ae1142
SSDEEP

768:FHeShZpSern/Z0RI8lexCL5KoThZVL4ckkx9c/UK0EDDqnjV5WLNtZXzhOn:BpZpSer/ZalXZVLDkH/UCkuLHJzhO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3476	2284	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 2284	4580	rundll32.exe	81
PID 4580 wrote to memory of 2284	4580	rundll32.exe	81
PID 4580 wrote to memory of 2284	4580	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\PriamNPAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\PriamNPAPI.dll,#1
  2⤵
  PID:2284
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 620
    3⤵
    - Program crash
    PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2284 -ip 2284
1⤵
PID:1376