717374926f2d2a078ef2a541497ce30e7a0283add5b111251ec8a41ecd200bb2

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 11:07

Target

$PLUGINSDIR/System.dll
Size

12KB
MD5

acd12e950b2ced1b5690f682d2c15b25
SHA1

639a1d0aaf669896377074281186cb6372811fd6
SHA256

6a28f1529bd59bc04f0519e086d2946ec4f09f5e4e6f30d2afb3c3585001dccf
SHA512

131bd07208d2d8c18ee9da36ce95e3c4a8d8acbb55fa96fc5a0affbc1d6e6b0ca733e9dd70ef1d5a0e15f91d88dbe1fe2c0656ea80b5a51e536ac54ab53110b4
SSDEEP

192:qA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:+R7SrtTv53tdtTgwF4SQbGPX36wJMw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2364	2052	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28
PID 2244 wrote to memory of 2052	2244	rundll32.exe	28
PID 2052 wrote to memory of 2364	2052	rundll32.exe	29
PID 2052 wrote to memory of 2364	2052	rundll32.exe	29
PID 2052 wrote to memory of 2364	2052	rundll32.exe	29
PID 2052 wrote to memory of 2364	2052	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 224
    3⤵
    - Program crash
    PID:2364