578928c21365636a5901841722431bc78f5c13b31ccc7cf81a7ead52f9db8457

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 16:18

Target

$PLUGINSDIR/intlib.dll
Size

24KB
MD5

1efbbf5a54eb145a1a422046fd8dfb2c
SHA1

ec4efd0a95bb72fd4cf47423647e33e5a3fddf26
SHA256

983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
SHA512

7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb
SSDEEP

384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1764 1572 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1764	1572	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2476 wrote to memory of 1572	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 1572	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 1572	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 1572	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 1572	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 1572	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 1572	2476	rundll32.exe	rundll32.exe
PID 1572 wrote to memory of 1764	1572	rundll32.exe	WerFault.exe
PID 1572 wrote to memory of 1764	1572	rundll32.exe	WerFault.exe
PID 1572 wrote to memory of 1764	1572	rundll32.exe	WerFault.exe
PID 1572 wrote to memory of 1764	1572	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\intlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\intlib.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 236
3⤵
- Program crash
PID:1764