96a126e677b6d6f51b7d1407aa159b04e31d6dcf8b9d9dda49d0f00976e872ef

Analysis

max time kernel
447s
max time network
1170s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
04/07/2024, 14:17

Target

$PLUGINSDIR/AccessControl.dll
Size

13KB
MD5

28c87a09fdb49060aa4ab558a2832109
SHA1

9213a24964cd479eac91d01ad54190f9c11d0c75
SHA256

933cadcd3a463484bbb3c45077afda0edbb539dfbe988efad79a88cae63bf95f
SHA512

413b3afe5a3b139a199f2a6954edc055eee3b312c3dffd568cfdbe1f740f07a7c27fbf7b2a0b6e3c3dd6ee358ce96cc1ca821883f055bf63ddebda854384700d
SSDEEP

192:V26NwF1FF1bl9UsZBpDOjH3RGz47gnrVsybWZeAW4MwNR5yRR4XLLF/NTNIXoslk:T+1bYsZBwWsySZeIBZdP40l

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3176	3104	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 3104	1972	rundll32.exe	78
PID 1972 wrote to memory of 3104	1972	rundll32.exe	78
PID 1972 wrote to memory of 3104	1972	rundll32.exe	78

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AccessControl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AccessControl.dll,#1
  2⤵
  PID:3104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 468
    3⤵
    - Program crash
    PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3104 -ip 3104
1⤵
PID:4968