5a4be9e92cf84b6fdedef3623c4fc76a9a239e98f88c0c4368bbb72caafdda03

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-02-2024 11:47

Target

$PLUGINSDIR/StartMenu.dll
Size

7KB
MD5

abba50aeb1da3cd1ad1e79a89701b02e
SHA1

bff5bcc8cb0667934b6c743b3f64f6a594f06826
SHA256

7a4268edf9d327766f22d4126f8dd070db611836f5336af1a864a1f8cfa7939b
SHA512

b730cd5fdca693331e8789318aa5536950bfbd691ec4047eca8dce9f8a4b0f960210261a44fb502839c20f02a20c1027aca23c7e32b84f79c2cca3ba5a3ab13c
SSDEEP

96:UgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1t33hhEl7y:UgiqVPgK8K9eIdE9B/tnhg7

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2232	2236	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2012 wrote to memory of 2236	2012	rundll32.exe	28
PID 2236 wrote to memory of 2232	2236	rundll32.exe	29
PID 2236 wrote to memory of 2232	2236	rundll32.exe	29
PID 2236 wrote to memory of 2232	2236	rundll32.exe	29
PID 2236 wrote to memory of 2232	2236	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 224
    3⤵
    - Program crash
    PID:2232