b1483abce8edcfd6183ef2cf211445e63535fb304d70b16077d847e3a46e2cc3

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 17:05

Target

$PLUGINSDIR/ExtractDLLEx.dll
Size

7KB
MD5

ba4063f437abb349aa9120e9c320c467
SHA1

b045d785f6041e25d6be031ae2af4d4504e87b12
SHA256

73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
SHA512

48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a
SSDEEP

96:lyEPmi/06iLbX8SIP59L1MmqPbgkk/eWKCHGojGYYIF/ggiomsTeZUzI:lyEPmymbMbPZOz+/eWJmoUItiopTeZ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2084	3012	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 3012	2756	rundll32.exe	28
PID 2756 wrote to memory of 3012	2756	rundll32.exe	28
PID 2756 wrote to memory of 3012	2756	rundll32.exe	28
PID 2756 wrote to memory of 3012	2756	rundll32.exe	28
PID 2756 wrote to memory of 3012	2756	rundll32.exe	28
PID 2756 wrote to memory of 3012	2756	rundll32.exe	28
PID 2756 wrote to memory of 3012	2756	rundll32.exe	28
PID 3012 wrote to memory of 2084	3012	rundll32.exe	29
PID 3012 wrote to memory of 2084	3012	rundll32.exe	29
PID 3012 wrote to memory of 2084	3012	rundll32.exe	29
PID 3012 wrote to memory of 2084	3012	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExtractDLLEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExtractDLLEx.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 228
    3⤵
    - Program crash
    PID:2084