4e32bec63d6c3bd84610060a50c7bffb89a7e19c2d41953b613d20f3d74dba2d

Analysis

max time kernel
29s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 18:35

Target

plugins/streamer.dll
Size

235KB
MD5

7477d1fa17cc49434d3f2535758d3953
SHA1

2873741669e06720718b4c05cc9512b36938100a
SHA256

e1ebb301bb05859d6aedde494c2fe7e102df0c79e1b9a575d8dee8fa0296cc6f
SHA512

60d95b90e90fa031121216e04df81e5a0b816fe49ac58712c21a3a7ed02ee75236ce98c572149d3bde2a67ac02138a010df50c83b0ae8ab3be68feca53190ca9
SSDEEP

3072:HPmx4ysuRVx9nVvPdhx6nIHQEPCYTbGyZTwKZUR7HGANOrP1zwnrOZqzxF+VC:v6DswlPD8IC8UR7mAcP1zwrOZqu

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1708 1620 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1708	1620	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 364 wrote to memory of 1620	364	rundll32.exe	rundll32.exe
PID 364 wrote to memory of 1620	364	rundll32.exe	rundll32.exe
PID 364 wrote to memory of 1620	364	rundll32.exe	rundll32.exe
PID 364 wrote to memory of 1620	364	rundll32.exe	rundll32.exe
PID 364 wrote to memory of 1620	364	rundll32.exe	rundll32.exe
PID 364 wrote to memory of 1620	364	rundll32.exe	rundll32.exe
PID 364 wrote to memory of 1620	364	rundll32.exe	rundll32.exe
PID 1620 wrote to memory of 1708	1620	rundll32.exe	WerFault.exe
PID 1620 wrote to memory of 1708	1620	rundll32.exe	WerFault.exe
PID 1620 wrote to memory of 1708	1620	rundll32.exe	WerFault.exe
PID 1620 wrote to memory of 1708	1620	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\streamer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\streamer.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 224
    3⤵
    - Program crash
    PID:1708

memory/1620-54-0x0000000000000000-mapping.dmp

Download
memory/1620-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1708-56-0x0000000000000000-mapping.dmp

Download