debf351be78e09aba6a74dd649077d4b7ed011f244b6e0e0ab3c75577828862f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 08:24

Target

$PLUGINSDIR/UAC.dll
Size

16KB
MD5

acfb66ee6fc1f4266229ec6098fe1740
SHA1

e1aeb31b11996015d7f17308e2f2bbe69d4e1476
SHA256

6d7e8070fa09cc4bb66fb99c2b88d0f5419602fa64a519437f430d9378300b1e
SHA512

bf0b5b22c57c08c88b4cbdd75bdf0c8eac433d42b4d163349391b71bc44d913e4d0e28e0826a7c27b418e6d2aa37c08c90577b56baa946a8f129486fbe01c303
SSDEEP

192:u9ALVfpLcFB5yoMINGXZ8YJJS6gGi21FNZRfUOPwiAGQMAW5s+2oA5D8t8A:SAL/S0xIkZ8CL7hfUOPGMAW5BkDod

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2408	1936	WerFault.exe	22

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1936	780	rundll32.exe	22
PID 780 wrote to memory of 1936	780	rundll32.exe	22
PID 780 wrote to memory of 1936	780	rundll32.exe	22
PID 780 wrote to memory of 1936	780	rundll32.exe	22
PID 780 wrote to memory of 1936	780	rundll32.exe	22
PID 780 wrote to memory of 1936	780	rundll32.exe	22
PID 780 wrote to memory of 1936	780	rundll32.exe	22
PID 1936 wrote to memory of 2408	1936	rundll32.exe	29
PID 1936 wrote to memory of 2408	1936	rundll32.exe	29
PID 1936 wrote to memory of 2408	1936	rundll32.exe	29
PID 1936 wrote to memory of 2408	1936	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 224
    3⤵
    - Program crash
    PID:2408