557c52ce5b2287387b843a22af6e4b84b200f67e4c869a7812f713b050d73f9a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 11:04

Target

$PLUGINSDIR/DLLDownLoader.dll
Size

28KB
MD5

0d613461983c6a2ed1be2e57b67e3ec7
SHA1

274e134bff3a1cc2b15b84f5c7d42f039ce0504f
SHA256

cb0b9edbf618082037aee9c618a7e28da3f66fa01210b425c08ddacd65bdc44c
SHA512

cbf8f2d9612740ab697ed495011cd7ffe2a6873f229374c0d0bc034bdfdfe07d5f65d8f6b6835db52ed8c133bfe141ff5bf08c23065902701cfa90c468b8911d
SSDEEP

96:t+RBpCB8OnNWxYeUXiJsVgcAOErirmYDi1w32wJVoilgtxMTuRQTGo1Qlo:t+RKDnYUPScymr1lGwJigaxMTZTNGu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1592	2560	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2560	1956	rundll32.exe	28
PID 1956 wrote to memory of 2560	1956	rundll32.exe	28
PID 1956 wrote to memory of 2560	1956	rundll32.exe	28
PID 1956 wrote to memory of 2560	1956	rundll32.exe	28
PID 1956 wrote to memory of 2560	1956	rundll32.exe	28
PID 1956 wrote to memory of 2560	1956	rundll32.exe	28
PID 1956 wrote to memory of 2560	1956	rundll32.exe	28
PID 2560 wrote to memory of 1592	2560	rundll32.exe	29
PID 2560 wrote to memory of 1592	2560	rundll32.exe	29
PID 2560 wrote to memory of 1592	2560	rundll32.exe	29
PID 2560 wrote to memory of 1592	2560	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLDownLoader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLDownLoader.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 248
    3⤵
    - Program crash
    PID:1592