e11e1d02027ed589370e37310fb3c4e607cc29e305a201dc2cbc04ee94579153

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 04:46

Target

$PLUGINSDIR/CustomInetc.dll
Size

21KB
MD5

81e20eb6c3a6002a805265ca751c7217
SHA1

db0e645b6d22b77b4117fb5612a0bf83c613c199
SHA256

3c0d6c3ee0784b2f10093a927335382f67050156136991f0ae05fa4484bab8f4
SHA512

ae6b594bd6cb42913484b5c5282757a9e8f52e76647bf3ef49555c2080540be683079f7994050a7baa45f7a2f57441fcd23353f351476f2891912ec5d2bfc2cf
SSDEEP

384:96WBKKhxKPJeXt0OxyfWB9VTZVWav3ARHKpK/V3STMvDya4m0Ac9khYLMkIX0+Gg:99nKPZfUZVzv3ARHKwhSYvWa4uL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
636	1504	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 1504	4468	rundll32.exe	81
PID 4468 wrote to memory of 1504	4468	rundll32.exe	81
PID 4468 wrote to memory of 1504	4468	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CustomInetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CustomInetc.dll,#1
  2⤵
  PID:1504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 624
    3⤵
    - Program crash
    PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1504 -ip 1504
1⤵
PID:3120