f40fdc94d6692812e7ad056d5c5b5a7c212baa7abff156ed1de0b2a3bf17f2dc

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 07:15

Target

Miranda IM/Plugins/chat.dll
Size

204KB
MD5

c59ef67e5439117f1365df78a6501d89
SHA1

4e400e540318e5d075874a065de373660ed6f32f
SHA256

5eef4c4fb303ef6fcbe873a82f317b83b3bfc06794a2319315e66b2acac6f97c
SHA512

3752cc7fb2b487e7c87a02a556d295133c689af93306780c302899e69a4f7d076361f51c3cb10c16262d580ecf38cb9bcadcb90cf97b7537a6b6bdf9e8812a20
SSDEEP

1536:sMzUFolW/WAvJXlI9iXMfofhHqBlM2g9T4jf/JCZNS8hxVjixAPZ6/t/biuhTGZM:ZzUeAvJXuQfhHq/Pg9T2JCFpevWM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2232	2220	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2220	2980	rundll32.exe	28
PID 2980 wrote to memory of 2220	2980	rundll32.exe	28
PID 2980 wrote to memory of 2220	2980	rundll32.exe	28
PID 2980 wrote to memory of 2220	2980	rundll32.exe	28
PID 2980 wrote to memory of 2220	2980	rundll32.exe	28
PID 2980 wrote to memory of 2220	2980	rundll32.exe	28
PID 2980 wrote to memory of 2220	2980	rundll32.exe	28
PID 2220 wrote to memory of 2232	2220	rundll32.exe	29
PID 2220 wrote to memory of 2232	2220	rundll32.exe	29
PID 2220 wrote to memory of 2232	2220	rundll32.exe	29
PID 2220 wrote to memory of 2232	2220	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Miranda IM\Plugins\chat.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Miranda IM\Plugins\chat.dll",#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 228
    3⤵
    - Program crash
    PID:2232