e3bef3c169ed317c459bf9d52958a6ae4d4bf753ba6224ee4878e6bbddca067d

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 21:30

Target

$PLUGINSDIR/UAC.dll
Size

13KB
MD5

b0151ae4287a740988b242c5cf715032
SHA1

db33b1f1d7e9c3346f06c360e102a3fe765a0522
SHA256

60314da07d2dfd677408c32c768e0f6cdeee94c42ea8ee2b94ad8fa3789259b5
SHA512

bee28871ee4711759dc3748a622c8cd748045398bb392179e20e53aa32d049fc89c3952d0123885ac46aa6d225bb7b821dc7532160230c5a396e930530139b7b
SSDEEP

192:yWjgr9lWIs6YwW2T8/JbIYu5vEQ1hGkG7OCF2YCinfDdvWjT7bTR38LnURr7k5:pgBlW6YFB07JErXz/tMT7bTRMUA5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2372	1932	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1932	2204	rundll32.exe	28
PID 2204 wrote to memory of 1932	2204	rundll32.exe	28
PID 2204 wrote to memory of 1932	2204	rundll32.exe	28
PID 2204 wrote to memory of 1932	2204	rundll32.exe	28
PID 2204 wrote to memory of 1932	2204	rundll32.exe	28
PID 2204 wrote to memory of 1932	2204	rundll32.exe	28
PID 2204 wrote to memory of 1932	2204	rundll32.exe	28
PID 1932 wrote to memory of 2372	1932	rundll32.exe	29
PID 1932 wrote to memory of 2372	1932	rundll32.exe	29
PID 1932 wrote to memory of 2372	1932	rundll32.exe	29
PID 1932 wrote to memory of 2372	1932	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 228
    3⤵
    - Program crash
    PID:2372