3c803e52fe005b478351638f6015604bb6a5cba23539860fed9455c093e92be9

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/02/2024, 01:34

Target
$PLUGINSDIR/DcryptDll.dll
Size 18KB
Sample240205-bzg7vsffc5
SHA256 db8917ced7cdce480313476ddcf5ebf700fed92d0a347f1db96f47cb5378422d
MD5 e8192915d70fcb1107486e48b3b16a7a
SHA1 ec9d2eba81dbc631c907c6b0a3cbe55897f1325f
SHA512 86ad3eff31a22b31f1619d24469c41db0075bc5aa2590603a70b377766197589135bea53be1687b9f136eff4608529202da7b40de94e2342cda7ac6dd74a5a33
SSDEEP 384:AZyQSewDbPmRqcXx2kMPrd9cbkUmR08EMT6:AbtwnmR/xQdckUSEMT6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	2000	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2000	2536	rundll32.exe	28
PID 2536 wrote to memory of 2000	2536	rundll32.exe	28
PID 2536 wrote to memory of 2000	2536	rundll32.exe	28
PID 2536 wrote to memory of 2000	2536	rundll32.exe	28
PID 2536 wrote to memory of 2000	2536	rundll32.exe	28
PID 2536 wrote to memory of 2000	2536	rundll32.exe	28
PID 2536 wrote to memory of 2000	2536	rundll32.exe	28
PID 2000 wrote to memory of 2668	2000	rundll32.exe	29
PID 2000 wrote to memory of 2668	2000	rundll32.exe	29
PID 2000 wrote to memory of 2668	2000	rundll32.exe	29
PID 2000 wrote to memory of 2668	2000	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DcryptDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DcryptDll.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 228
    3⤵
    - Program crash
    PID:2668