02b2807a96708694d9b8f2f229b4d36bb1d6bbce35e910c82f87e65a4e5b08b0

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 17:59

Target
$PLUGINSDIR/inetc.dll
Size 29KB
Sample240309-wkpcvaeb57
SHA256 37adc0183d94ae6ca1895643423dac0c97750d7103e6b00c14299dfc4ad2271e
MD5 dccdcb124064a1d9a5eb12232348b898
SHA1 f294fac154cb1c6c18fe054ac584f767594b93fb
SHA512 bd89bcd513bb7120db80e1115b4caceaa18c4ea863fe29b232002d447c3813133ff2849fcb2d4df45e3ff67e0e0d9d340d61060b9c74045b17efa5b1c1f5b05e
SSDEEP 384:c4Z8sUAUNuGGsPVPEZ+OLkCnFJDhgvZwcRa9h9S4y4fO7nYPLWUHWteM9Ms8:cG8sUAUnt88CFJDhmajMAWtsP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1708	2008	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2008	2844	rundll32.exe	28
PID 2844 wrote to memory of 2008	2844	rundll32.exe	28
PID 2844 wrote to memory of 2008	2844	rundll32.exe	28
PID 2844 wrote to memory of 2008	2844	rundll32.exe	28
PID 2844 wrote to memory of 2008	2844	rundll32.exe	28
PID 2844 wrote to memory of 2008	2844	rundll32.exe	28
PID 2844 wrote to memory of 2008	2844	rundll32.exe	28
PID 2008 wrote to memory of 1708	2008	rundll32.exe	29
PID 2008 wrote to memory of 1708	2008	rundll32.exe	29
PID 2008 wrote to memory of 1708	2008	rundll32.exe	29
PID 2008 wrote to memory of 1708	2008	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 236
    3⤵
    - Program crash
    PID:1708