d81fdcc0520f1f01645e978ae21fcd7e01887044249d7ee1d0e018a6832320a5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 19:00

Target

$PLUGINSDIR/InetLoad.dll
Size

18KB
MD5

f37c31e52d78ef073192200a7fd2d43a
SHA1

2cecd5aa9924e9928b0fcbf69167f65e4cd49e74
SHA256

87cb74da17d1d376a4ac44411017017f43816a858e9085c340779b92ce705e71
SHA512

282aba1c61d559a083dfc309ce20dd96aaf471af7d7771a8703ab8ea7f6ccae5a40b1ddc3c98da95f5664a1afdeb5813b19a42a4302ec2af05c168c8eadc4eda
SSDEEP

384:YkwWEILlrHNzG4QAx1Dofrn9l3isW1cyMjPzy0Ac9k+LMkIX1+GnUXzX6p:Yi9HVWADgn9l3isW1rMjPz4rp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2304	3496	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 3496	4380	rundll32.exe	82
PID 4380 wrote to memory of 3496	4380	rundll32.exe	82
PID 4380 wrote to memory of 3496	4380	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoad.dll,#1
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 624
    3⤵
    - Program crash
    PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3496 -ip 3496
1⤵
PID:4816