350f2b7af2310de1eec502397eb73b1e5c909b989294a1e988911c07a8ec616c

Analysis

max time kernel
125s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 21:40

Target

$PLUGINSDIR/luacom.dll
Size

287KB
MD5

ed7f7857933b38e5d10daf828e79af19
SHA1

7f1445f87f7e2256efc33ef56da20c3b23a1e0f9
SHA256

9dd5218bc2d12f4d07e268bc6ec01d6eefde4b99a07246d0a96d18477d331b5b
SHA512

ceaf9597d4cb725c4ec8b7af8d1090b38df102b52ca7606a24e9a094fc81f450f93ad22770c905db9115e271fa5fa4f5731caa7b1875e204edb10fb691741715
SSDEEP

6144:sdCVNGq2AcLGcmiuarKjKekqqBVq2Zq++++o++++++qjZfl8++O+yW+s+W+hZa+u:wCVT2nqciarKjKekqqBVq2Zq++++o+++

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5092	2876	WerFault.exe	90

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 2876	3128	rundll32.exe	90
PID 3128 wrote to memory of 2876	3128	rundll32.exe	90
PID 3128 wrote to memory of 2876	3128	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\luacom.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\luacom.dll,#1
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 652
    3⤵
    - Program crash
    PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2876 -ip 2876
1⤵
PID:1324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3764,i,5095735526234624271,6356691058050835509,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:8
1⤵
PID:3436

memory/2876-0-0x0000000002690000-0x00000000026B8000-memory.dmp

Filesize
160KB

Download