4d085c99ff295582f3aba758345adec2527f11841cdaa78f38fccd200c38167f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 22:07

Target

$PLUGINSDIR/StartMenu.dll
Size

7KB
MD5

9cead166a7e6b41e0d9f1d81dac6c5fb
SHA1

0ea553bb919c135ac9167bce5cef97da6787ad63
SHA256

39de086aafa16c8f24c72fa14c3635260a1080bad2a4ef39591721cc7112b307
SHA512

f882f796579121f576e67adf4104151a680ca87becca360e914d8ff6abdc5250c933dce4ae56b029b2642b5571819c4500407c0c3df6cff92b184d2c7bcff156
SSDEEP

96:YRJxbgt7V4Cc7Dm9JvAB3odlZQ6WhiQ8tcG4Z71h:YRrbgncG99Y3icGCB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	1632	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1632	2992	rundll32.exe	28
PID 2992 wrote to memory of 1632	2992	rundll32.exe	28
PID 2992 wrote to memory of 1632	2992	rundll32.exe	28
PID 2992 wrote to memory of 1632	2992	rundll32.exe	28
PID 2992 wrote to memory of 1632	2992	rundll32.exe	28
PID 2992 wrote to memory of 1632	2992	rundll32.exe	28
PID 2992 wrote to memory of 1632	2992	rundll32.exe	28
PID 1632 wrote to memory of 1912	1632	rundll32.exe	29
PID 1632 wrote to memory of 1912	1632	rundll32.exe	29
PID 1632 wrote to memory of 1912	1632	rundll32.exe	29
PID 1632 wrote to memory of 1912	1632	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 224
    3⤵
    - Program crash
    PID:1912