19b460ecdd81029cc8a816363dcc8468626eb2a0514f3e34c4189b69c6e02ec7

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 13:35

Target

$PLUGINSDIR/UAC.dll
Size

16KB
MD5

acfb66ee6fc1f4266229ec6098fe1740
SHA1

e1aeb31b11996015d7f17308e2f2bbe69d4e1476
SHA256

6d7e8070fa09cc4bb66fb99c2b88d0f5419602fa64a519437f430d9378300b1e
SHA512

bf0b5b22c57c08c88b4cbdd75bdf0c8eac433d42b4d163349391b71bc44d913e4d0e28e0826a7c27b418e6d2aa37c08c90577b56baa946a8f129486fbe01c303
SSDEEP

192:u9ALVfpLcFB5yoMINGXZ8YJJS6gGi21FNZRfUOPwiAGQMAW5s+2oA5D8t8A:SAL/S0xIkZ8CL7hfUOPGMAW5BkDod

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3196	3612	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 3612	4228	rundll32.exe	81
PID 4228 wrote to memory of 3612	4228	rundll32.exe	81
PID 4228 wrote to memory of 3612	4228	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  PID:3612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 624
    3⤵
    - Program crash
    PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3612 -ip 3612
1⤵
PID:4180