e3b42b1d66a2514e6e6eb0689b9b0a797d824510cab1754cabf6d92dba65a6a6

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 09:10

Target

$PLUGINSDIR/GdiPlus.dll
Size

1.7MB
MD5

0c38476c6e51c95144f648b78fb579d8
SHA1

1a85ebc7203e7f0dc5297e6c5a056d52d45c447c
SHA256

04495ada069d6d176f14115738782cc8660c575e90046919a02792c274260f02
SHA512

5800fd07a1ab41a14aa1d413d0d2e54583e61086937bbc6b9b8901726f6944fb75fabc45ef1ae44ca9a0b00240c5df50a8a826ce7f2a33581ec21f9fd47be8d1
SSDEEP

24576:uxnzzlD7ReVXjqvyigpv71+h3A6DZq0PCFUm1zfvDf73zJAMd5fUzDHyZ201pKK5:uBzpD700KVwh3TA0PCUuz73aknXKKjN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	2536	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2184 wrote to memory of 2536	2184	rundll32.exe	28
PID 2536 wrote to memory of 2504	2536	rundll32.exe	29
PID 2536 wrote to memory of 2504	2536	rundll32.exe	29
PID 2536 wrote to memory of 2504	2536	rundll32.exe	29
PID 2536 wrote to memory of 2504	2536	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GdiPlus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GdiPlus.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 220
    3⤵
    - Program crash
    PID:2504