0463b4e565fdeeb1511beea6e9d152ec3939298c20fdef976a52c1d8b5ecdfb0

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:44

Target

$PLUGINSDIR/TkNsweb.dll
Size

59KB
MD5

c6731fd774db4835a5763afd404a50eb
SHA1

c6b20b36631b513ca8647d952b95469b77d2ac24
SHA256

23861a8828cedc363baa54760766c01fdd9e1414073ca1148ff9a19ca818b13a
SHA512

c3eca3f693f4ff6b078e0708c70156f2184708f0e07d40f3cd54dd24556ae6e010a89b9bfb777f4131f0d0ee0f87d79015e7eb8f0b2606fa156d846dd581e197
SSDEEP

768:LGGFsrrp6e7co2DLJUcUw9nf/bsJVtCcdWANKDrYsWjcdvCQFEzLr+M4dk:LGdNRIrLJUBwZUvCcdgYsWjcdqQdvk

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2200 2480 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2200	2480	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2060 wrote to memory of 2480	2060	rundll32.exe	rundll32.exe
PID 2060 wrote to memory of 2480	2060	rundll32.exe	rundll32.exe
PID 2060 wrote to memory of 2480	2060	rundll32.exe	rundll32.exe
PID 2060 wrote to memory of 2480	2060	rundll32.exe	rundll32.exe
PID 2060 wrote to memory of 2480	2060	rundll32.exe	rundll32.exe
PID 2060 wrote to memory of 2480	2060	rundll32.exe	rundll32.exe
PID 2060 wrote to memory of 2480	2060	rundll32.exe	rundll32.exe
PID 2480 wrote to memory of 2200	2480	rundll32.exe	WerFault.exe
PID 2480 wrote to memory of 2200	2480	rundll32.exe	WerFault.exe
PID 2480 wrote to memory of 2200	2480	rundll32.exe	WerFault.exe
PID 2480 wrote to memory of 2200	2480	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TkNsweb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TkNsweb.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 236
3⤵
- Program crash
PID:2200