a148412a5c1cc9aba0ecdbb3e44010aeac75b40f23492bd04c0127e558aa44ac

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 04:31

Target

OfferboxChromePlugin.dll
Size

68KB
MD5

ae42cc8f93664bf54c6baa3da2a0e114
SHA1

e218a977513b8799ef5891f57baf90fda1a76ec6
SHA256

9e0dba0d22cd19d9a54e7154cf1a93d961fac4adfcc09f67a28f384988bf4e11
SHA512

eabe87eacf539f4f5795eae2cf8000b52bb12647a1b91fdc08c4a1d7aad13ca521214d9aa7cf0d3dcb1a64b382e8d01e5163a8beb263bb90c9d6a2599c0642f3
SSDEEP

1536:MEKLP8wS42H+Ge7R6fbHOk5q2qFatyCNA:MnLP8wr4HOk5qJQtbA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2524	2032	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2032	2532	rundll32.exe	28
PID 2532 wrote to memory of 2032	2532	rundll32.exe	28
PID 2532 wrote to memory of 2032	2532	rundll32.exe	28
PID 2532 wrote to memory of 2032	2532	rundll32.exe	28
PID 2532 wrote to memory of 2032	2532	rundll32.exe	28
PID 2532 wrote to memory of 2032	2532	rundll32.exe	28
PID 2532 wrote to memory of 2032	2532	rundll32.exe	28
PID 2032 wrote to memory of 2524	2032	rundll32.exe	29
PID 2032 wrote to memory of 2524	2032	rundll32.exe	29
PID 2032 wrote to memory of 2524	2032	rundll32.exe	29
PID 2032 wrote to memory of 2524	2032	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\OfferboxChromePlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\OfferboxChromePlugin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 220
    3⤵
    - Program crash
    PID:2524