79af1f9153b8ff988baffaa164fc70799950078f887e2c93dc3fa7efed674b21

Analysis

max time kernel
292s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 22:20

Target

$PLUGINSDIR/System.dll
Size

31KB
MD5

dab726bff7cb0f079d232b2c4d0efd8d
SHA1

4d0ebe0facbb66c9c03e3f6b5beb411cb75d9ec9
SHA256

9d46463e1925bf29cd86c7a56ccf540f1eeef3cb50064a222b84703436cd7e8c
SHA512

6aa6097777afdcb073b8fc8ace1a244ac9215ec152720d8b4a32f6196181b135a900491c7fea72bf1df9ed69e51b90cd21eca4ed902d8503d0b1b04c162a2162
SSDEEP

384:Q/h37/UFERnoxFtgQw+S4nebga3ZBB/Ykv44IwwH9tPPPPPPPPPP6MIkwQeKe/u+:QNQyVOFSR+SfTZlvCH91ze3WAz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1852	1508	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1508 wrote to memory of 1852	1508	rundll32.exe	29
PID 1508 wrote to memory of 1852	1508	rundll32.exe	29
PID 1508 wrote to memory of 1852	1508	rundll32.exe	29
PID 1508 wrote to memory of 1852	1508	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 220
    3⤵
    - Program crash
    PID:1852

memory/1508-0-0x0000000074F00000-0x0000000074F10000-memory.dmp

Filesize
64KB

Download