e67777b181a1ca1f21890bd0da9b177bcd850498375af8f1b0d3d61c7a54c9d0

Analysis

max time kernel
139s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 12:35

Target

$PLUGINSDIR/GdiPlus.dll
Size

1.7MB
MD5

0c38476c6e51c95144f648b78fb579d8
SHA1

1a85ebc7203e7f0dc5297e6c5a056d52d45c447c
SHA256

04495ada069d6d176f14115738782cc8660c575e90046919a02792c274260f02
SHA512

5800fd07a1ab41a14aa1d413d0d2e54583e61086937bbc6b9b8901726f6944fb75fabc45ef1ae44ca9a0b00240c5df50a8a826ce7f2a33581ec21f9fd47be8d1
SSDEEP

24576:uxnzzlD7ReVXjqvyigpv71+h3A6DZq0PCFUm1zfvDf73zJAMd5fUzDHyZ201pKK5:uBzpD700KVwh3TA0PCUuz73aknXKKjN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4140	232	WerFault.exe	91

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 232	3428	rundll32.exe	91
PID 3428 wrote to memory of 232	3428	rundll32.exe	91
PID 3428 wrote to memory of 232	3428	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GdiPlus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GdiPlus.dll,#1
  2⤵
  PID:232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 624
    3⤵
    - Program crash
    PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 232 -ip 232
1⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3808,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:8
1⤵
PID:3572