e11e1d02027ed589370e37310fb3c4e607cc29e305a201dc2cbc04ee94579153

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 04:46

Target
$PLUGINSDIR/CustomBrandingURL.dll
Size 5KB
Sample240703-feecpasbmr
SHA256 2c33db8babc38e9c824d025b594626dfeee67c5319dc93396239899647f87156
MD5 e4c1b74859c17671ffe1c0602fd56b44
SHA1 15ae7d83122a1dc14d79e6c0a2e6565a9ffc12d1
SHA512 9dda77eaa71371d3e1d068d3740435b5aa3f198818e46ae31e19cab8b084bb131e088241abf1a0f7f78179745a1665a9bf500f97ee25cafc7f85c5a1c234a925
SSDEEP 48:SMq1qEwUNRYDeKPTeKp4GN8C8hgIV2f4ag5pmy8WywlhQ7sp9CSC2bH:hq1q/QPKSKp4m80i2QGpvwLXLCtGH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1004	1136	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1136	1172	rundll32.exe	81
PID 1172 wrote to memory of 1136	1172	rundll32.exe	81
PID 1172 wrote to memory of 1136	1172	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CustomBrandingURL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CustomBrandingURL.dll,#1
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 608
    3⤵
    - Program crash
    PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1136 -ip 1136
1⤵
PID:2256