75128be2810392ee9cb9f4d4c847332bd943a321179bb3bc13395bf546caa2fe

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 15:44

Target
$PLUGINSDIR/AdvSplash.dll
Size 6KB
Sample240716-s6gckszblm
SHA256 5e71559df5cbcc4d98ebd9d4ddffabe18b047f9a50d98a96e46a4c0ac589105c
MD5 7a514e97fb29eccff3c7ab5147f4de9a
SHA1 e573f6e51d26d5601c68b7370fa94a030e561a9f
SHA512 f320dd5b60c5f1a6cba69b399d32151ca13c2b10f873f0c3cc05c3f1707ca80b396c5fc71175269117e0a6c13e56c51b89ea1dee47879fcc62d29f6ea8087604
SSDEEP 96:0NcIcmLEjNev3O2obNnNlXUjDftqlqCstWpgwoS:xIpLSG3O9XX+qlqntWpg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4564	1376	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1376	1284	rundll32.exe	83
PID 1284 wrote to memory of 1376	1284	rundll32.exe	83
PID 1284 wrote to memory of 1376	1284	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AdvSplash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AdvSplash.dll,#1
  2⤵
  PID:1376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 616
    3⤵
    - Program crash
    PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1376 -ip 1376
1⤵
PID:3152