7a74fb60899179d6a5696a266139cde1f7a05660c73fccf636650e643ae67d21

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-01-2024 17:50

Target

$PLUGINSDIR/Dialer.dll
Size

3KB
MD5

692da284b3212a65a8092e6f02804c05
SHA1

852b2943a19f0a7de5e6fa2a47aee8a2ce8e3c66
SHA256

0d9663a5d1eab84f531dcac47a2366d215207ac488f9d452832c5efb91a6d1f9
SHA512

978a8ec097d30c2a8729670e8fdf46464e84c9e701b9739e4937991c07cd06003c0bb01e77ad1e10f30b7ae2fb62b5b7bc724bce4ce644b09177899c6bacb21f

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	2184	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2184	2532	rundll32.exe	28
PID 2532 wrote to memory of 2184	2532	rundll32.exe	28
PID 2532 wrote to memory of 2184	2532	rundll32.exe	28
PID 2532 wrote to memory of 2184	2532	rundll32.exe	28
PID 2532 wrote to memory of 2184	2532	rundll32.exe	28
PID 2532 wrote to memory of 2184	2532	rundll32.exe	28
PID 2532 wrote to memory of 2184	2532	rundll32.exe	28
PID 2184 wrote to memory of 2224	2184	rundll32.exe	29
PID 2184 wrote to memory of 2224	2184	rundll32.exe	29
PID 2184 wrote to memory of 2224	2184	rundll32.exe	29
PID 2184 wrote to memory of 2224	2184	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 228
    3⤵
    - Program crash
    PID:2224