66ccc6e593b5218712e81a0283b418fb8fc4e5055343f3e3fa0e2dc1b7b0cec3

Analysis

max time kernel
140s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 20:15

Target

plugins/PriamNPAPI.dll
Size

55KB
MD5

0912d0ccfd6cbefe2bd6b4473d006771
SHA1

ed9dad52f3ae71472b810bfa71159d448cf3e68d
SHA256

c8493605aae1563e133b20543d02aa421f477b9a955fd547f7d2c7cdc1dd787d
SHA512

dfbe41244bfc321a9efa717924bc8cd527d422eded98c4bd0c3c8391a0bdb8619571f2c757a825cadd145ce07b235714625326fc4c16ccaef67d71a576ae1142
SSDEEP

768:FHeShZpSern/Z0RI8lexCL5KoThZVL4ckkx9c/UK0EDDqnjV5WLNtZXzhOn:BpZpSer/ZalXZVLDkH/UCkuLHJzhO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	4132	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 4132	2732	rundll32.exe	84
PID 2732 wrote to memory of 4132	2732	rundll32.exe	84
PID 2732 wrote to memory of 4132	2732	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\PriamNPAPI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\PriamNPAPI.dll,#1
  2⤵
  PID:4132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 620
    3⤵
    - Program crash
    PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4132 -ip 4132
1⤵
PID:3872