1a212857d3edcfe44cfdf0ac50db27a1fb325721f7fd9aa9a1e8fcc8b4bda64c

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 00:13

Target

$PLUGINSDIR/pathedit.dll
Size

227KB
MD5

472b1782f3e5a9f4d182abf6d3d303c5
SHA1

6d2b041189bf8d350f2eb9e8b0c21e1c77590047
SHA256

07d2f4173b3518a99c63b8ff316b5edfbdf0018331be774a3de9172a60e7322c
SHA512

98abd505b4e763b1da38c887f316db5a40515e7a1ad7650aed56ddd9f45c9d84151726a5cbdd7af3c29746b4868089550a74b125f075949e6f9621a5aefe60f0
SSDEEP

3072:y2zI5yma+6agPKbqvq6d5zHYQrxNKQBPvy0t5pXcTQJA1R3uAg0FuD0mN13XzV5Z:bIAhquHB2EHy0t5RcT6AOdz38AqeNI3M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	1488	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 2512 wrote to memory of 1488	2512	rundll32.exe	28
PID 1488 wrote to memory of 1708	1488	rundll32.exe	29
PID 1488 wrote to memory of 1708	1488	rundll32.exe	29
PID 1488 wrote to memory of 1708	1488	rundll32.exe	29
PID 1488 wrote to memory of 1708	1488	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\pathedit.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\pathedit.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 224
    3⤵
    - Program crash
    PID:1708