755d11ba3943ba14071f4bdb5b10d3a1db96fdbf637a2851317304aa2523a4b4

Analysis

max time kernel
90s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 09:12

Target

Plugins/FX/reainsert.dll
Size

29KB
MD5

caec266b2ea12b8318e789cf93c3c39b
SHA1

666d29b06d17ea256670f32375a354a99340bf33
SHA256

ea91906627c64b5afd947ba426950d5136e1a28552f7596cca71890a40505cc5
SHA512

893866b03b6f783da810c4eb85a251505676aa0dacc14ea3a182f3c1936ead6b28802a0545684e4613ecd84c4974d339165fb5ace0806eb1ce96d3d88cf61f13
SSDEEP

384:J12jLCON4K/gz/SvVr275OGlV9DC2XNYtjRLHNHNE+qqwI+YRo:uj+O2qK/4yD7pCgNiVHNHkqwI+Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3152	4864	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4864	5108	rundll32.exe	79
PID 5108 wrote to memory of 4864	5108	rundll32.exe	79
PID 5108 wrote to memory of 4864	5108	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reainsert.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reainsert.dll,#1
  2⤵
  PID:4864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 616
    3⤵
    - Program crash
    PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4864 -ip 4864
1⤵
PID:1916