f40fdc94d6692812e7ad056d5c5b5a7c212baa7abff156ed1de0b2a3bf17f2dc

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 07:15

Target

Miranda IM/Plugins/ICQ.dll
Size

282KB
MD5

0ee9add58d8eb148c1e5b8eb550f6ae8
SHA1

27e7d567ee6873d1026aa5b340aa80e596a204bb
SHA256

28ace9ccc34cf90a9ef09084fe430888e8232b9c048c9faf21053c53756911e5
SHA512

7727c32b78464930375e58dddfacfe7c4353a5a7c01b3ee03355eb422ceed84db283fe7640ff9ed460aff7176726f3430dacc5f164775fb26425c742c85e6642
SSDEEP

3072:IJ1ycsl0Ld0tABBUOs/hAtaiKr3TXxj72xYDpBYS5rKfzTe+ntVF5lCo7R4mlhXH:AwbK2O41iKBiVtn5rfdHUK5CDa1J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
548	2864	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2864	2168	rundll32.exe	28
PID 2168 wrote to memory of 2864	2168	rundll32.exe	28
PID 2168 wrote to memory of 2864	2168	rundll32.exe	28
PID 2168 wrote to memory of 2864	2168	rundll32.exe	28
PID 2168 wrote to memory of 2864	2168	rundll32.exe	28
PID 2168 wrote to memory of 2864	2168	rundll32.exe	28
PID 2168 wrote to memory of 2864	2168	rundll32.exe	28
PID 2864 wrote to memory of 548	2864	rundll32.exe	29
PID 2864 wrote to memory of 548	2864	rundll32.exe	29
PID 2864 wrote to memory of 548	2864	rundll32.exe	29
PID 2864 wrote to memory of 548	2864	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Miranda IM\Plugins\ICQ.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Miranda IM\Plugins\ICQ.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 228
    3⤵
    - Program crash
    PID:548