88fcfb4aa99e99cb38660d6346ce989abf4569019cfd58cc762b6314a7c1f7e9

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 10:31

Target
$PLUGINSDIR/INetC.dll
Size 25KB
Sample240202-mkdrnsdhfk
SHA256 6bccf372e490c49a3850e4f326c6a988e08991bbfe6e89b9c35d3efe29d304c4
MD5 bcf627d0db38c8e772e292b509a625de
SHA1 8ee208ff94930571b176ef92dba1c5ef5dd9c415
SHA512 234c83b48e2f6e650a955cadcb227345f38392fc05101d21611c576307595a99e2e357be7ab6dc7d6d0a0deef501bc29dbca12907821cae9d9e2c8f17e21f7c1
SSDEEP 384:XH7Nzpqwkh7R0EOrHn/ZeQaWbJQ2+r9e9dVpyeWZwcAyHEazjJ:Pi0EOT/5aWbJLSAvVpyd3J
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2404	2940	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2940	3068	rundll32.exe	28
PID 3068 wrote to memory of 2940	3068	rundll32.exe	28
PID 3068 wrote to memory of 2940	3068	rundll32.exe	28
PID 3068 wrote to memory of 2940	3068	rundll32.exe	28
PID 3068 wrote to memory of 2940	3068	rundll32.exe	28
PID 3068 wrote to memory of 2940	3068	rundll32.exe	28
PID 3068 wrote to memory of 2940	3068	rundll32.exe	28
PID 2940 wrote to memory of 2404	2940	rundll32.exe	29
PID 2940 wrote to memory of 2404	2940	rundll32.exe	29
PID 2940 wrote to memory of 2404	2940	rundll32.exe	29
PID 2940 wrote to memory of 2404	2940	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\INetC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\INetC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 236
    3⤵
    - Program crash
    PID:2404