48eda05ebc3353d6a9386a9796a76c42395caa2ab9894936ee59484b17369fbf

Analysis

max time kernel
95s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 05:15

Target
$PLUGINSDIR/InetLoadEx.dll
Size 55KB
Sample240715-fxzrcaserc
SHA256 73f4a1529acf2ea56d4db9ed8134bed0498cea38903105f7c2af8cc7d11b8db3
MD5 9fae574b1004bb0650eebba3d8040c59
SHA1 541583ec14af05915b8efefe520edd4f25914c9a
SHA512 ab25c429301f2d8a2da6b7c2a222c4028ad8e393c67dde83606762a8ba49c6c49460538624a799969dd0b3c810623d7e471c65a390e8661228a621580d7d54c7
SSDEEP 768:WFKaQrcF+ntygjX/+qEg469TRphsguCtPQpcQaa5jZ19K:WIaQrs0kgjx9TRsg1ox5H
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4204	4088	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 4088	2932	rundll32.exe	85
PID 2932 wrote to memory of 4088	2932	rundll32.exe	85
PID 2932 wrote to memory of 4088	2932	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoadEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoadEx.dll,#1
  2⤵
  PID:4088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 624
    3⤵
    - Program crash
    PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4088 -ip 4088
1⤵
PID:1540