bacf1ae72d809382dc9ceba302a3f1fc91542620767e9d34e5caab2a2619e133

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 05:41

Target

$PLUGINSDIR/Base64.dll
Size

3KB
MD5

5cd56a89f090c3dd0b4d98dfeb3b648d
SHA1

7c1a2a72cdd2f13bd095a4d2eda6b3a9806e7334
SHA256

71d1f1bdaaf23618aa36f6e648b35aada1dc6f1ad0eaf8570cdab5f26d8601a9
SHA512

e69a2eb5e8d21da58478fe99ee86341a735bdc3ee05caeb05ae388e9f82f4f577cb687381dc64060cffc6fe5b835a6c104b06b8d6dcc19337cdc48f1a69927ae

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1376	3052	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3052	1216	rundll32.exe	28
PID 1216 wrote to memory of 3052	1216	rundll32.exe	28
PID 1216 wrote to memory of 3052	1216	rundll32.exe	28
PID 1216 wrote to memory of 3052	1216	rundll32.exe	28
PID 1216 wrote to memory of 3052	1216	rundll32.exe	28
PID 1216 wrote to memory of 3052	1216	rundll32.exe	28
PID 1216 wrote to memory of 3052	1216	rundll32.exe	28
PID 3052 wrote to memory of 1376	3052	rundll32.exe	29
PID 3052 wrote to memory of 1376	3052	rundll32.exe	29
PID 3052 wrote to memory of 1376	3052	rundll32.exe	29
PID 3052 wrote to memory of 1376	3052	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Base64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Base64.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 228
    3⤵
    - Program crash
    PID:1376