2e31b1e1b0821c7a6529c74e0f1cb4ab435dceaf933467696c41d981bf43cf2a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 16:39

Target

$PLUGINSDIR/Ischeck.dll
Size

120KB
MD5

6c1f65ce96712e05f64c7a26b7adee36
SHA1

6cea6c2618fb31902c52cb1d5fad04503bd34ed0
SHA256

544f3c2c03f7900539d4868437f8e08204c0b4c79357af666a1fb48d406c1ffd
SHA512

5244d26d013dc2c7083bd4c167cac99307985babcabc1806a898a2621fce6b73d256b21d549bce8744f3221a51017ea5f621d2f6f5cd5aae83ec21ae41e5d5a6
SSDEEP

1536:1ki0RcSLEMxwjoTolPh9zyZFTEPmayYgH+t7Q0LtJhpdcOoyoJaZGUttW:IA/VHeZCP3ybHLK3hpdcO1oJaZttW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1556	4912	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 4912	1536	rundll32.exe	83
PID 1536 wrote to memory of 4912	1536	rundll32.exe	83
PID 1536 wrote to memory of 4912	1536	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Ischeck.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Ischeck.dll,#1
  2⤵
  PID:4912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 652
    3⤵
    - Program crash
    PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4912 -ip 4912
1⤵
PID:2796