30aecb1d0bb7c6f8de3f21937ff121ccfee96e0454a1e9a156fefbf8accc8770

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 08:22

Target

$PLUGINSDIR/Checker.dll
Size

41KB
MD5

1ebcb7fe4d8f8f975dd404d1688d1e1a
SHA1

cff12da173ae6e6660870e6343aac823e013ebc3
SHA256

c78112c3da52d30b98c4cb34d3b9baf406f85a4dc975c40a6949672122c8ed37
SHA512

7ec29be35c39b8fb623eb1f624df984031bc26fb7c99d7375b754ac1bda383e318d01eeae2672a79db6e5b177e29d97a2eb0d60385a80f4a26a5006c7e0173fe
SSDEEP

768:NNZoBQfjXtKahyIXlQWBh/GxHxn2hEDVyx1jZv79FN:NNZwApK0XlLYd9o99L

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2836	1896	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1896	2060	rundll32.exe	28
PID 2060 wrote to memory of 1896	2060	rundll32.exe	28
PID 2060 wrote to memory of 1896	2060	rundll32.exe	28
PID 2060 wrote to memory of 1896	2060	rundll32.exe	28
PID 2060 wrote to memory of 1896	2060	rundll32.exe	28
PID 2060 wrote to memory of 1896	2060	rundll32.exe	28
PID 2060 wrote to memory of 1896	2060	rundll32.exe	28
PID 1896 wrote to memory of 2836	1896	rundll32.exe	29
PID 1896 wrote to memory of 2836	1896	rundll32.exe	29
PID 1896 wrote to memory of 2836	1896	rundll32.exe	29
PID 1896 wrote to memory of 2836	1896	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Checker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Checker.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 224
    3⤵
    - Program crash
    PID:2836