03a948c55d5867c9d6a004819ab5a157825ad1e75fd2239d2040d0f12251f83c

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 19:36

Target

$PLUGINSDIR/utils.dll
Size

60KB
MD5

ae97029e01393cb7ba395504c49d9fe2
SHA1

247b4e1b4100b8ba426fe8957b9de3f32b1bbaee
SHA256

eff23a5d372e18b5647ab812e7600eaa84a893ce64f72c96e02592b96f93866b
SHA512

5bdb06feeeb8ec51a760e804678ed9d67b7622466b40004d6ff4304d6e3e2b5c3dd6a377ce71a025b5658865f826c97069219c0a763ba28ba01d0127949fbc51
SSDEEP

768:mZjOX1HRn5MO7b0u6lv1hssQ55o4bECSq5GatiR:SjOFBE9hrg5olOtiR

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	2352	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2088 wrote to memory of 2352	2088	rundll32.exe	28
PID 2352 wrote to memory of 2164	2352	rundll32.exe	29
PID 2352 wrote to memory of 2164	2352	rundll32.exe	29
PID 2352 wrote to memory of 2164	2352	rundll32.exe	29
PID 2352 wrote to memory of 2164	2352	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\utils.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\utils.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 236
    3⤵
    - Program crash
    PID:2164