f40fdc94d6692812e7ad056d5c5b5a7c212baa7abff156ed1de0b2a3bf17f2dc

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 07:15

Target

Miranda IM/Plugins/GG.dll
Size

194KB
MD5

eb159f3805cdf99b195f52d37e5863bb
SHA1

0eb7ec94ccce6335adbac069e996faa7126129cd
SHA256

cbfbe9f7f8313f42abd6cc18c2b9115ed42191bfca2e87b2d87297b77a9533ea
SHA512

1641d290c492414af58b24c50b3396137fa17e33c58d19e417d13222b4fd9a00173bb06edc62979fe2aedefe955ed76407c75d4d3e5a0d5ba826912f9f5b4347
SSDEEP

3072:C875VqObyBzJA5WWius/Psqb7Q49LStJNoL0X0/kzIgZHTEShQPLaztWdyjDrlWp:75VPwETo/PlQKLSz66oc7TM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2112	2088	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2088	2932	rundll32.exe	17
PID 2932 wrote to memory of 2088	2932	rundll32.exe	17
PID 2932 wrote to memory of 2088	2932	rundll32.exe	17
PID 2932 wrote to memory of 2088	2932	rundll32.exe	17
PID 2932 wrote to memory of 2088	2932	rundll32.exe	17
PID 2932 wrote to memory of 2088	2932	rundll32.exe	17
PID 2932 wrote to memory of 2088	2932	rundll32.exe	17
PID 2088 wrote to memory of 2112	2088	rundll32.exe	16
PID 2088 wrote to memory of 2112	2088	rundll32.exe	16
PID 2088 wrote to memory of 2112	2088	rundll32.exe	16
PID 2088 wrote to memory of 2112	2088	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Miranda IM\Plugins\GG.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Miranda IM\Plugins\GG.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 264
1⤵
- Program crash
PID:2112