350f2b7af2310de1eec502397eb73b1e5c909b989294a1e988911c07a8ec616c

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 21:40

Target

$PLUGINSDIR/customNsWeb.dll
Size

24KB
MD5

876f1eb34f5a03a38b3341985012576f
SHA1

28e61eca2458c82d5320f1b3bf69909d31efe885
SHA256

260c227997f45056ce666aa8ecf94bc604ba78138af3c25771dc01a8c1bc5a15
SHA512

00b47b239074b97fa86b690a3172b546278b44899df0d5c084e9bec3165688695bdee3c500e407d961ed0159d0f25e3f6d79b08c7983d2848ae4dc3ce4d36502
SSDEEP

192:q5uPMQL58fxUZ15Svm2fd5ywsjC9l7Gh3clkD/7tjuXJtt/fvrViEDLkjn01xcPF:qgL5U0HSvFfGx3uFJ/Vijjn0HFI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4956	2700	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2700	2348	rundll32.exe	83
PID 2348 wrote to memory of 2700	2348	rundll32.exe	83
PID 2348 wrote to memory of 2700	2348	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\customNsWeb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\customNsWeb.dll,#1
  2⤵
  PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 636
    3⤵
    - Program crash
    PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2700 -ip 2700
1⤵
PID:400