a827aeef1409269f76c80f60250f45b379cd688e6800c14bd767478dcdfdfb75

Analysis

max time kernel
96s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 09:45

Target

$PLUGINSDIR/svrreg.dll
Size

1.5MB
MD5

9984d4d8a4d912e4a1c34dd9324e2356
SHA1

7693138b480aa2bfae44b3b07649f30e09ae7e62
SHA256

e9133b9aff90f271881fefa99f562fbd2860d874e723f5945e72d04b9d6b2474
SHA512

28cd31da030b0ea13e7b96b1bd3e41f61e4c54fba63c9c650c5409ca669c16698a5610e126dca26d6de61e80d70f01b37183b8a82ccb2a75e54b6e4b6d9799f7
SSDEEP

24576:zL6B4nqJax6gF2+sGv6tPQ0hqNKo43duJFYxu1BJDVoR/FFATtMLX5CyXnxwYM7b:36B4nqJa1F2xo6tY5NS3dk1BJZojrIED

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
64	4472	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 4472	1632	rundll32.exe	82
PID 1632 wrote to memory of 4472	1632	rundll32.exe	82
PID 1632 wrote to memory of 4472	1632	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\svrreg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\svrreg.dll,#1
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4472 -s 672
    3⤵
    - Program crash
    PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4472 -ip 4472
1⤵
PID:3272