23e32fc9ede131e7e7454fd133a8b3275ff897b09248ee3b32c4f76c853f8842

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-01-2024 16:21

Target

$PLUGINSDIR/ipa.dll
Size

125KB
MD5

0453cd31a00d8b30697def769444a0d1
SHA1

932ee994523365d7d3beb65ca6f05e422fd9b588
SHA256

84e09bf2fd49b53a081635dffa617c05277212cabce857e0036bc70841e21853
SHA512

88c794d028822427a510a0ce988f4694ca5a195336d9e6233d4b523d6ff72f9c394d4cf95a16d391e9f68f0d9296bf922a790669bbcb82f4e3376e8bd307b817
SSDEEP

1536:nusH1VQXksIQY6+MqGMpt23cuMz/0Q9YHogbLhfVWAvv3pNAHtCSBnqcHRYZGPdF:ZVVzsIi+HI3X+oxBstDHhVoFQ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3036	3040	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3040	2940	rundll32.exe	28
PID 2940 wrote to memory of 3040	2940	rundll32.exe	28
PID 2940 wrote to memory of 3040	2940	rundll32.exe	28
PID 2940 wrote to memory of 3040	2940	rundll32.exe	28
PID 2940 wrote to memory of 3040	2940	rundll32.exe	28
PID 2940 wrote to memory of 3040	2940	rundll32.exe	28
PID 2940 wrote to memory of 3040	2940	rundll32.exe	28
PID 3040 wrote to memory of 3036	3040	rundll32.exe	29
PID 3040 wrote to memory of 3036	3040	rundll32.exe	29
PID 3040 wrote to memory of 3036	3040	rundll32.exe	29
PID 3040 wrote to memory of 3036	3040	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ipa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ipa.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 220
    3⤵
    - Program crash
    PID:3036