e791985263b2df4b00652a69f4d6ac925dd2e7a069b9cc30ccb6fc5c813ec44b

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 03:10

Target

$PLUGINSDIR/gplunger.dll
Size

139KB
MD5

bc5f89eaab81e7b404f5616536129cfa
SHA1

00e44b6e9327939b5db0931574dc5f1fccde7056
SHA256

3d76a243d61f3115828ba4fff522ba77787bf8ad3478f9310b5226da064f1a7a
SHA512

1bcb59fbc4c155c2892deed891dc47034ad3c4e078cedbbbd9828811b97cff6dfe111640b4ff195976df7f321d957e3b779085b6e5425593a71d4a948d38de63
SSDEEP

1536:22Wi0TsEfM+ahZ9crL6zX6sl4iqhmZC4WvmYRREMmhXSFwLtjCxmbSJ5cXuUH6:2dCTiIX54mtYrETCF8tjC8q5UT6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2888	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 1500 wrote to memory of 2888	1500	rundll32.exe	28
PID 2888 wrote to memory of 2748	2888	rundll32.exe	29
PID 2888 wrote to memory of 2748	2888	rundll32.exe	29
PID 2888 wrote to memory of 2748	2888	rundll32.exe	29
PID 2888 wrote to memory of 2748	2888	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gplunger.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gplunger.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 228
    3⤵
    - Program crash
    PID:2748