bacf1ae72d809382dc9ceba302a3f1fc91542620767e9d34e5caab2a2619e133

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-01-2024 05:41

Target

$PLUGINSDIR/SimpleSC.dll
Size

48KB
MD5

72b95a219d2525f9b1c2213ab9b8556c
SHA1

de5b369a18b8701ebb6852d3a4b0d55213f789e8
SHA256

0b6b5ef0835c570c4330e597eebfa00c2a13d4c5f043283b604e585fdaea6b4e
SHA512

2e31684638d136049c89cecee7a86360933845a0f115f145150b31a144bdd2b621d779392e14b0504e40c19a0c8e23a50f8b3534bc002b12150aa6cf12696596
SSDEEP

768:AutqkcrJvsz+w+S9CoMY7If7gQ1To2rIF/wYpyFmQAw1+04VtD//1GV4MCR:rtqkcrJvsRLMYcb1nYpyoLOwCmMCR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2520	3048	WerFault.exe	14

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3048	2944	rundll32.exe	14
PID 2944 wrote to memory of 3048	2944	rundll32.exe	14
PID 2944 wrote to memory of 3048	2944	rundll32.exe	14
PID 2944 wrote to memory of 3048	2944	rundll32.exe	14
PID 2944 wrote to memory of 3048	2944	rundll32.exe	14
PID 2944 wrote to memory of 3048	2944	rundll32.exe	14
PID 2944 wrote to memory of 3048	2944	rundll32.exe	14
PID 3048 wrote to memory of 2520	3048	rundll32.exe	16
PID 3048 wrote to memory of 2520	3048	rundll32.exe	16
PID 3048 wrote to memory of 2520	3048	rundll32.exe	16
PID 3048 wrote to memory of 2520	3048	rundll32.exe	16

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SimpleSC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 228
  2⤵
  - Program crash
  PID:2520

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SimpleSC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2944

memory/3048-0-0x0000000000170000-0x0000000000180000-memory.dmp

Filesize
64KB

Download
memory/3048-1-0x0000000000170000-0x0000000000180000-memory.dmp

Filesize
64KB

Download