4bbb6021ab01478496202bc0cfb7527b068a621093a823c8d02e696da8b6decb

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 05:47

Target

$PLUGINSDIR/AdvSplash.dll
Size

6KB
MD5

416dd1f9853a601f16c70ee016ee855f
SHA1

226a5aa251118f5e337d22017dd0861f2d8b21d3
SHA256

2cf08655bd37f2999612ced3b79d35b537e2b0cd281bb1f452c427879634e7de
SHA512

27e104a657eaed4cc8f58588385af6354d41785df98c8fc02eb436cb4372e3c0047ec28eab5ab37ef70ddca46fc9cf1cc86fc0d95267fff759ae7e610b5f8d6d
SSDEEP

96:VQNyX2PtUZsM88eo93NaqqhN51xWabkkEkk/StChwoo:VFXYt38B9V61dk/kkStCh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2704	2924	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2924	2672	rundll32.exe	28
PID 2672 wrote to memory of 2924	2672	rundll32.exe	28
PID 2672 wrote to memory of 2924	2672	rundll32.exe	28
PID 2672 wrote to memory of 2924	2672	rundll32.exe	28
PID 2672 wrote to memory of 2924	2672	rundll32.exe	28
PID 2672 wrote to memory of 2924	2672	rundll32.exe	28
PID 2672 wrote to memory of 2924	2672	rundll32.exe	28
PID 2924 wrote to memory of 2704	2924	rundll32.exe	29
PID 2924 wrote to memory of 2704	2924	rundll32.exe	29
PID 2924 wrote to memory of 2704	2924	rundll32.exe	29
PID 2924 wrote to memory of 2704	2924	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AdvSplash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AdvSplash.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 232
    3⤵
    - Program crash
    PID:2704