df743df0e6439937a24ab8d5de7deaff63912d8dccdc14fdabcb9404bfe3e5a7

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 10:53

Target

$PLUGINSDIR/inetc.dll
Size

20KB
MD5

9a7d35d1e9e5dfb6a7872d49cf64db83
SHA1

4da9dd5427c0fdfa2cce3ee29ac5147b74ff3834
SHA256

c7a365c50611e7b3bbec6f73e9b33fa83d9ca91c34cde67969cd7cab79293160
SHA512

cb98bc94b883ecd88102a017de484560085c0f70fa379489618cc10c017d543e53b12502a0a7cae49682887676c4c590fc481ab9cd531467b1d090499783db3a
SSDEEP

384:qYJFIiP3ZudtjmSBSWY1IAxNOzqXBrxzs0UhU7ya4LH0Ac9khYLMkIX0+G0cgLGh:qaBcdtjmsSW6IAxNQqXBrx40UhUua4Lx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4556	4660	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4660	2920	rundll32.exe	83
PID 2920 wrote to memory of 4660	2920	rundll32.exe	83
PID 2920 wrote to memory of 4660	2920	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
  2⤵
  PID:4660
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 624
    3⤵
    - Program crash
    PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4660 -ip 4660
1⤵
PID:3992