531313033fdb71c44c0791f56679e55c36f06fa6250f90f68ebaf42e7a2a044b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 06:29

Target

$PLUGINSDIR/Protocol.dll
Size

355KB
MD5

a0ec723d41810478bb659a85e4e92f3d
SHA1

24cc9fc77abcafe0dd1c5a4e547a8b4efd63c85f
SHA256

dd57149bfa1348e482afddbbe79187527cbd358cdb3036fdf4e8b9f446d020cf
SHA512

ed98dff026eff8501a526dc36c5f68b63adc5a1704881015d6a9f7af53e5a3a47da6aad8d054b7f7cf0821f479a016f45ad20a1b201c263a09cf8265cd772c4d
SSDEEP

6144:9ibLrat+Zbe/UnSKeWWhaAIMsmg/wQ2h/WS8emoDCnD3h7xKYJd098jOfA7Ku:9uzyXXJaAI+qh4SWDCt7xK00yOu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4976	2040	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 2040	1168	rundll32.exe	85
PID 1168 wrote to memory of 2040	1168	rundll32.exe	85
PID 1168 wrote to memory of 2040	1168	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Protocol.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Protocol.dll,#1
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 692
    3⤵
    - Program crash
    PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2040 -ip 2040
1⤵
PID:2320