06035c50bb3e3f927f2b9921697438c9acead3722c70a6a35fd857f454ed7373

Resubmissions

17-01-2024 20:15

17-01-2024 20:11

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17-01-2024 20:11

Target

$PLUGINSDIR/StdUtils.dll
Size

101KB
MD5

33b4e69e7835e18b9437623367dd1787
SHA1

53afa03edaf931abdc2d828e5a2c89ad573d926c
SHA256

72d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae
SHA512

ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77
SSDEEP

1536:Ayy+wx2YAlWrU5OX9crt5c4DBqiC7hk333kbQk:ry+wojIwgNcr1a7WH0b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2000	3036	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 3036	1264	rundll32.exe	28
PID 1264 wrote to memory of 3036	1264	rundll32.exe	28
PID 1264 wrote to memory of 3036	1264	rundll32.exe	28
PID 1264 wrote to memory of 3036	1264	rundll32.exe	28
PID 1264 wrote to memory of 3036	1264	rundll32.exe	28
PID 1264 wrote to memory of 3036	1264	rundll32.exe	28
PID 1264 wrote to memory of 3036	1264	rundll32.exe	28
PID 3036 wrote to memory of 2000	3036	rundll32.exe	29
PID 3036 wrote to memory of 2000	3036	rundll32.exe	29
PID 3036 wrote to memory of 2000	3036	rundll32.exe	29
PID 3036 wrote to memory of 2000	3036	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StdUtils.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 224
    3⤵
    - Program crash
    PID:2000