03a948c55d5867c9d6a004819ab5a157825ad1e75fd2239d2040d0f12251f83c

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 19:36

Target

$PLUGINSDIR/ThreadTimer.dll
Size

3KB
MD5

cc888fec62967cf5d03f9898e0cb65cb
SHA1

b219e1f82c318797eb36700d9d88d3eb461d382e
SHA256

7d9235c4c34be7ef9b31efcccfd97bc604d0cd4fb37df9b62ccbd1d460c20d96
SHA512

3578f5b36a85cd8726eff15335f6586a583dbee8542a95c5d4df6744ac0c5c41115c7f100cd4b7fb74094d13b22058152ec9fa6662587889427992444668ce41

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2124	1944	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1944	1968	rundll32.exe	28
PID 1968 wrote to memory of 1944	1968	rundll32.exe	28
PID 1968 wrote to memory of 1944	1968	rundll32.exe	28
PID 1968 wrote to memory of 1944	1968	rundll32.exe	28
PID 1968 wrote to memory of 1944	1968	rundll32.exe	28
PID 1968 wrote to memory of 1944	1968	rundll32.exe	28
PID 1968 wrote to memory of 1944	1968	rundll32.exe	28
PID 1944 wrote to memory of 2124	1944	rundll32.exe	29
PID 1944 wrote to memory of 2124	1944	rundll32.exe	29
PID 1944 wrote to memory of 2124	1944	rundll32.exe	29
PID 1944 wrote to memory of 2124	1944	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ThreadTimer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ThreadTimer.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 228
    3⤵
    - Program crash
    PID:2124