1a212857d3edcfe44cfdf0ac50db27a1fb325721f7fd9aa9a1e8fcc8b4bda64c

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 00:13

Target

$PLUGINSDIR/log.dll
Size

417KB
MD5

22dbe42726b3a7fe8e7c25a7f8000e2a
SHA1

5b9fc3f7c0ff32b6a89495be636ebe3a96bf9cdc
SHA256

9867b214572d1e72248cb2f7b2a0c0efdfaa0a4ae7c68cc53c143c34ec3086c0
SHA512

3a735cdb13a121ef86735a87f75c48000efb3592b0f03a6c94b4e010e9b4ff878eeecf35829e67413133e1b0103de4e03768d5ed858768894b98c86fa676e4e2
SSDEEP

6144:H0tzqCiEIZOU/MQ4DqjdhBDgi0fr6KnZBby/GbqQX/9jkqX2AOnvqKOC7qpkc:H0v3Ih/T1j9w6qZy/dwcqpkc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	1740	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1740	2196	rundll32.exe	28
PID 2196 wrote to memory of 1740	2196	rundll32.exe	28
PID 2196 wrote to memory of 1740	2196	rundll32.exe	28
PID 2196 wrote to memory of 1740	2196	rundll32.exe	28
PID 2196 wrote to memory of 1740	2196	rundll32.exe	28
PID 2196 wrote to memory of 1740	2196	rundll32.exe	28
PID 2196 wrote to memory of 1740	2196	rundll32.exe	28
PID 1740 wrote to memory of 3052	1740	rundll32.exe	29
PID 1740 wrote to memory of 3052	1740	rundll32.exe	29
PID 1740 wrote to memory of 3052	1740	rundll32.exe	29
PID 1740 wrote to memory of 3052	1740	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\log.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\log.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 224
    3⤵
    - Program crash
    PID:3052