a827aeef1409269f76c80f60250f45b379cd688e6800c14bd767478dcdfdfb75

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240708-en
resource tags

arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 09:45

Target

$PLUGINSDIR/services.dll
Size

7KB
MD5

89408795f143525890bbda9281c42f45
SHA1

bd9f08641cbe86d18c985cea5325dc2ad8525aa6
SHA256

065564c3d7e19e7dea083fb9a426dfdfeabba6ca3a7587bee938f75db5753114
SHA512

ba11a243b97326f6cd12f7f6f8b81e67f7e8f55b5dcf63a7e705813f85c9af1866891770077514051ce153527b074dcba2881b94bdb1925dedc81354e9a84cd6
SSDEEP

96:XrXHYWyrDznMnpuQQQjGVw1DVjjQrFUsuL579yAwEN3sKPqg3k+9tyz:XzbcUpuQQcCSDVjjQrFDkZ9Fw+3fiYH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4936	3900	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 3900	2316	rundll32.exe	81
PID 2316 wrote to memory of 3900	2316	rundll32.exe	81
PID 2316 wrote to memory of 3900	2316	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\services.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\services.dll,#1
  2⤵
  PID:3900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 612
    3⤵
    - Program crash
    PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3900 -ip 3900
1⤵
PID:2428