a827aeef1409269f76c80f60250f45b379cd688e6800c14bd767478dcdfdfb75

Analysis

max time kernel
95s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 09:45

Target

$PLUGINSDIR/wingfavi.dll
Size

1.6MB
MD5

96c2faa6800f061e2e03f6368b12dad4
SHA1

43a339e298e6786dff59c68d2ab6793fe34bc6a0
SHA256

f5d055f3ec74394ea4e988d9476b00107542bfc40032b6bf99b5662c42c33b98
SHA512

a283c3ebb906f0d6d6b43d4f99da851c9ad6884676da7e9c9dfcd809c4563f1e562e03cde4c9b76e1ad75fb0c784ebcbf5d17a81fdf59d4b99d5d95fcf70111f
SSDEEP

49152:q4riMwYihpeVd9dwfCmky77XZp+zNVZeg0mFUqfo07xXm:qjMIhpeVndwfCmky77pEzNVZeE6Co07g

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1432	4820	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 4820	3236	rundll32.exe	83
PID 3236 wrote to memory of 4820	3236	rundll32.exe	83
PID 3236 wrote to memory of 4820	3236	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\wingfavi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\wingfavi.dll,#1
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 676
    3⤵
    - Program crash
    PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4820 -ip 4820
1⤵
PID:2248