e3bef3c169ed317c459bf9d52958a6ae4d4bf753ba6224ee4878e6bbddca067d

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 02:03

Target

$PLUGINSDIR/UAC.dll
Size

13KB
MD5

b0151ae4287a740988b242c5cf715032
SHA1

db33b1f1d7e9c3346f06c360e102a3fe765a0522
SHA256

60314da07d2dfd677408c32c768e0f6cdeee94c42ea8ee2b94ad8fa3789259b5
SHA512

bee28871ee4711759dc3748a622c8cd748045398bb392179e20e53aa32d049fc89c3952d0123885ac46aa6d225bb7b821dc7532160230c5a396e930530139b7b
SSDEEP

192:yWjgr9lWIs6YwW2T8/JbIYu5vEQ1hGkG7OCF2YCinfDdvWjT7bTR38LnURr7k5:pgBlW6YFB07JErXz/tMT7bTRMUA5

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
848	2628	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2628	2968	rundll32.exe	28
PID 2968 wrote to memory of 2628	2968	rundll32.exe	28
PID 2968 wrote to memory of 2628	2968	rundll32.exe	28
PID 2968 wrote to memory of 2628	2968	rundll32.exe	28
PID 2968 wrote to memory of 2628	2968	rundll32.exe	28
PID 2968 wrote to memory of 2628	2968	rundll32.exe	28
PID 2968 wrote to memory of 2628	2968	rundll32.exe	28
PID 2628 wrote to memory of 848	2628	rundll32.exe	29
PID 2628 wrote to memory of 848	2628	rundll32.exe	29
PID 2628 wrote to memory of 848	2628	rundll32.exe	29
PID 2628 wrote to memory of 848	2628	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 224
    3⤵
    - Program crash
    PID:848