29db1b7a9d12cc1f8fc1f4b8feb617961bc57ce3e0d6fd162ebd94f2737cc289

Analysis

max time kernel
140s
max time network
128s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 22:00

Target

$PLUGINSDIR/MakeDll.dll
Size

397KB
MD5

a238c105313222f7378fe1ee693953ff
SHA1

e232c2c0119817e4dcc00ad435dff4a7ed0456c2
SHA256

c80c07b2bc18efdeae53d850a3e64cb995480adea78bce6463265ada98a87f52
SHA512

41675fb499cb7c8e09c74cf5878db824da13a64da427d755bea7b1edd4bc1313f31f8d87eec71a10019fdda4b33f7606466a9cc1979a2e90071b3d2e3be3f77e
SSDEEP

6144:67ELuk4cTX1ARqPvCudXWy3oanscbvDJQk7e2q/H8EIINRBT9fNsaKfjemm0WSl:Mk48ARqPvVaQNrqNP8ER9lsaonjf

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1628	1840	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1840	2260	rundll32.exe	28
PID 2260 wrote to memory of 1840	2260	rundll32.exe	28
PID 2260 wrote to memory of 1840	2260	rundll32.exe	28
PID 2260 wrote to memory of 1840	2260	rundll32.exe	28
PID 2260 wrote to memory of 1840	2260	rundll32.exe	28
PID 2260 wrote to memory of 1840	2260	rundll32.exe	28
PID 2260 wrote to memory of 1840	2260	rundll32.exe	28
PID 1840 wrote to memory of 1628	1840	rundll32.exe	29
PID 1840 wrote to memory of 1628	1840	rundll32.exe	29
PID 1840 wrote to memory of 1628	1840	rundll32.exe	29
PID 1840 wrote to memory of 1628	1840	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MakeDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MakeDll.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 244
    3⤵
    - Program crash
    PID:1628

memory/1840-0-0x00000000001B0000-0x0000000000219000-memory.dmp

Filesize
420KB

Download
memory/1840-1-0x00000000001B0000-0x0000000000219000-memory.dmp

Filesize
420KB

Download