6a601568e74adf93814c278ab2d63e19b6c7107f26b3acecb0a9423f3c4c9a87

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 02:34

Target

$PLUGINSDIR/timepro.dll
Size

20KB
MD5

009dbbdd1ef470dd752c2b73835da3e7
SHA1

f97da6556b24302df8201a092eaa32a80d49064b
SHA256

c1ed8c398108dc56fbb6fd6797c3c9df59447e2a2f198b72a45058124971b09c
SHA512

dbffa0eb830b292e5550eb3f3cfce90f881282652afb0463672ece7eb0946c34a8f75c4852f77b1db3604f0f346d0ed9d9babbad40b41de109e9f5119d555ec5
SSDEEP

48:iPDeRFIHpvCelHXKvDRnEungRnEYngia6JsRhdt3Ft5GoO1JqN1:kfhlRKdnEungRnEYngia5X3Ft5GF1J

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
856	1360	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1360	2088	rundll32.exe	28
PID 2088 wrote to memory of 1360	2088	rundll32.exe	28
PID 2088 wrote to memory of 1360	2088	rundll32.exe	28
PID 2088 wrote to memory of 1360	2088	rundll32.exe	28
PID 2088 wrote to memory of 1360	2088	rundll32.exe	28
PID 2088 wrote to memory of 1360	2088	rundll32.exe	28
PID 2088 wrote to memory of 1360	2088	rundll32.exe	28
PID 1360 wrote to memory of 856	1360	rundll32.exe	29
PID 1360 wrote to memory of 856	1360	rundll32.exe	29
PID 1360 wrote to memory of 856	1360	rundll32.exe	29
PID 1360 wrote to memory of 856	1360	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\timepro.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\timepro.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 224
    3⤵
    - Program crash
    PID:856