c605bbb80497f649c14f03846249dbe6c72ac434ec1e1ef9292e80f1d92b832b

Analysis

max time kernel
93s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 02:56

Target

$PLUGINSDIR/System.dll
Size

11KB
MD5

bff2a11d26d951ec34679b8fa1ee7192
SHA1

d3de629a5a86ee35b6afa1802f6ac8b141b07062
SHA256

aec5af9c7c551c3590492b0c0120b535b55ab048e84f695b617a5ab4b1a52f54
SHA512

1dce397c9cab3cd3b58c181688286a89067c743f195403694819c2d988435268ffd01939beaaa17cfa344160c89414f28273b70de154be0def034af8c470723a
SSDEEP

192:G9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:GJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3196	1684	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1684	8	rundll32.exe	83
PID 8 wrote to memory of 1684	8	rundll32.exe	83
PID 8 wrote to memory of 1684	8	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  PID:1684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 612
    3⤵
    - Program crash
    PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1684 -ip 1684
1⤵
PID:2580