35288cc9856deb3cd3a5d47364073420671b323fb0d887621e47b69f53a24ceb

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 07:31

Target

$PLUGINSDIR/ExLicenseBoanSupportPage.dll
Size

48KB
MD5

fa7057b96c5e0ee2a356d96f82393204
SHA1

bd0695fdafbe72299a826a1e13d32b47d4f94317
SHA256

11761fc0fba2b78083e2d46f14afedd0345e0650134f9f557ed83b417311b3d3
SHA512

5216102ac3a4ad444a5b632ceadd257d904405325ca4766ffaa5ff598188ab945a5c9f3483071f3b161374e8a900a508089db420d5241a5196ee8cc20846039a
SSDEEP

384:9TC+WJzIuhKvncN1ZbOgYC+938m0kNyDt82LvnJviXnCO4u:95uIgWWbOgYxJ8tSSti4

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1608	1520	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1520	4476	rundll32.exe	84
PID 4476 wrote to memory of 1520	4476	rundll32.exe	84
PID 4476 wrote to memory of 1520	4476	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExLicenseBoanSupportPage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExLicenseBoanSupportPage.dll,#1
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 624
    3⤵
    - Program crash
    PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1520 -ip 1520
1⤵
PID:2516