23821db04107d705b9b6a16a867aa01c55fc77f4e002efc9263e133d090b5b35

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 14:25

Target

$PLUGINSDIR/LuaBridge.dll
Size

56KB
MD5

4773de0d19eba2e605eabcc632cd9e79
SHA1

5279562175548f1655df285bfe09fcbcce84c986
SHA256

1e5276ca5ec9eb3b62303fbc259b9cccb1722fd1321bb4e3054c231c97a14cad
SHA512

8a72a667953885e5884f9e9dfd021a6ec6fa4b05a46cbeb8fa9b5fc1f95d32ea11ebb579bae20ab85459b0f25044d59239462b7318c454365951c54f387bee53
SSDEEP

1536:7pUaOLGBp3rMRtCgEWWlhHz60a+8Dx/Q0+f:dU5LApctDCVa+Ux/Q0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2324	2376	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2376	1924	rundll32.exe	28
PID 1924 wrote to memory of 2376	1924	rundll32.exe	28
PID 1924 wrote to memory of 2376	1924	rundll32.exe	28
PID 1924 wrote to memory of 2376	1924	rundll32.exe	28
PID 1924 wrote to memory of 2376	1924	rundll32.exe	28
PID 1924 wrote to memory of 2376	1924	rundll32.exe	28
PID 1924 wrote to memory of 2376	1924	rundll32.exe	28
PID 2376 wrote to memory of 2324	2376	rundll32.exe	29
PID 2376 wrote to memory of 2324	2376	rundll32.exe	29
PID 2376 wrote to memory of 2324	2376	rundll32.exe	29
PID 2376 wrote to memory of 2324	2376	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaBridge.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaBridge.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 232
    3⤵
    - Program crash
    PID:2324

memory/2376-0-0x0000000074DF0000-0x0000000074E4E000-memory.dmp

Filesize
376KB

Download