19ffddf2e9e4958d30a147598268fcf3e60bab780384f5f9fa34e20a075a4812

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 15:10

Target

$PLUGINSDIR/System.dll
Size

22KB
MD5

b361682fa5e6a1906e754cfa08aa8d90
SHA1

c6701aee0c866565de1b7c1f81fd88da56b395d3
SHA256

b711c4f17690421c9dc8ddb9ed5a9ddc539b3a28f11e19c851e25dcfc7701c04
SHA512

2778f91c9bcf83277d26c71118a1ccb0fb3ce50e89729f14f4915bc65dd48503a77b1e5118ce774dea72f5ce3cc8681eb9ca3c55cf90e9f61a177101ba192ae9
SSDEEP

384:78+Qlt70Fj/lQRY/9VjjgLZvDGFtart8E9VFK4ietffvtlh:7SqFjm6YL1DGFo+EA6tlh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2220	2868	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2868	2460	rundll32.exe	28
PID 2460 wrote to memory of 2868	2460	rundll32.exe	28
PID 2460 wrote to memory of 2868	2460	rundll32.exe	28
PID 2460 wrote to memory of 2868	2460	rundll32.exe	28
PID 2460 wrote to memory of 2868	2460	rundll32.exe	28
PID 2460 wrote to memory of 2868	2460	rundll32.exe	28
PID 2460 wrote to memory of 2868	2460	rundll32.exe	28
PID 2868 wrote to memory of 2220	2868	rundll32.exe	29
PID 2868 wrote to memory of 2220	2868	rundll32.exe	29
PID 2868 wrote to memory of 2220	2868	rundll32.exe	29
PID 2868 wrote to memory of 2220	2868	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 224
    3⤵
    - Program crash
    PID:2220