005cc5fcee47af9761a6d41b5789683ad454ffa416a7bd7a9d3472ddf9fc230e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 02:55

Target

$PLUGINSDIR/FileInfo.dll
Size

589KB
MD5

96db521a774244bbab1de9d93d2b0a64
SHA1

27c8304e4b17a5a59d414de8ef77b056609c21bc
SHA256

f79eaaa02157d6f4cd44d3282ae039ced8ac9fac964ea4d7ed7c12ca92f5833c
SHA512

b0bc0e858e0a98c9c7e3f5479249fb4f9f6a92f7680fc437950e94499fe0dff3f778a8c2f8f0dd6d5d61fd9a209817bb59d3166d1f19d9adf1ee2153e00859c3
SSDEEP

12288:v1M3EgrfsgXqaW2SLHuOjcqUEETcw7/MvLhaQ1THqJe6A8UFNNP:v8EhGS3Q70vLY4TH+ej8UFfP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2928	2232	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2232	2896	rundll32.exe	28
PID 2896 wrote to memory of 2232	2896	rundll32.exe	28
PID 2896 wrote to memory of 2232	2896	rundll32.exe	28
PID 2896 wrote to memory of 2232	2896	rundll32.exe	28
PID 2896 wrote to memory of 2232	2896	rundll32.exe	28
PID 2896 wrote to memory of 2232	2896	rundll32.exe	28
PID 2896 wrote to memory of 2232	2896	rundll32.exe	28
PID 2232 wrote to memory of 2928	2232	rundll32.exe	29
PID 2232 wrote to memory of 2928	2232	rundll32.exe	29
PID 2232 wrote to memory of 2928	2232	rundll32.exe	29
PID 2232 wrote to memory of 2928	2232	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 220
    3⤵
    - Program crash
    PID:2928