b5a7df1bce14af47db87f45e2ee5c2f53408d181da89d3490298e49714902a03

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 08:52

Target

$PLUGINSDIR/MReport.dll
Size

89KB
MD5

22c91de8e4517c4e8af2cf3ad50a7464
SHA1

e045d5158e108dac4de4365190dbd17ce5b65064
SHA256

5d06bca579f9a7c37d8e319d77db3781f081e11d977ba4689b2765d8ec631a8a
SHA512

8e465d74e95dd4fea905bb622a30a67608bbd0328234b9d03829c043463396aa0c53222e8fc5983d7824590345c377dc766e1dbd10a8a5cb848f396781f89d46
SSDEEP

1536:5tJ+f0gtQ9axFG04j/2XrRBvjD2svI1QUwn4Pk8IqGCAHhRER56mNp:56FG0FzvfvmC43GCAHhOR56A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5016	3316	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 3316	1392	rundll32.exe	85
PID 1392 wrote to memory of 3316	1392	rundll32.exe	85
PID 1392 wrote to memory of 3316	1392	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MReport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MReport.dll,#1
  2⤵
  PID:3316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 632
    3⤵
    - Program crash
    PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3316 -ip 3316
1⤵
PID:1244