5d69d2238d1ffe8d41093c10c64aaaade2e74e6a1ee0bcdd3f554e027efd3b74

Analysis

max time kernel
92s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 03:22

Target

$PLUGINSDIR/DLLDownLoader.dll
Size

28KB
MD5

0d613461983c6a2ed1be2e57b67e3ec7
SHA1

274e134bff3a1cc2b15b84f5c7d42f039ce0504f
SHA256

cb0b9edbf618082037aee9c618a7e28da3f66fa01210b425c08ddacd65bdc44c
SHA512

cbf8f2d9612740ab697ed495011cd7ffe2a6873f229374c0d0bc034bdfdfe07d5f65d8f6b6835db52ed8c133bfe141ff5bf08c23065902701cfa90c468b8911d
SSDEEP

96:t+RBpCB8OnNWxYeUXiJsVgcAOErirmYDi1w32wJVoilgtxMTuRQTGo1Qlo:t+RKDnYUPScymr1lGwJigaxMTZTNGu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3164	4476	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4476	3368	rundll32.exe	80
PID 3368 wrote to memory of 4476	3368	rundll32.exe	80
PID 3368 wrote to memory of 4476	3368	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLDownLoader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLDownLoader.dll,#1
  2⤵
  PID:4476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 664
    3⤵
    - Program crash
    PID:3164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4476 -ip 4476
1⤵
PID:4172