5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 02:41

Target

$PLUGINSDIR/System.dll
Size

12KB
MD5

acd12e950b2ced1b5690f682d2c15b25
SHA1

639a1d0aaf669896377074281186cb6372811fd6
SHA256

6a28f1529bd59bc04f0519e086d2946ec4f09f5e4e6f30d2afb3c3585001dccf
SHA512

131bd07208d2d8c18ee9da36ce95e3c4a8d8acbb55fa96fc5a0affbc1d6e6b0ca733e9dd70ef1d5a0e15f91d88dbe1fe2c0656ea80b5a51e536ac54ab53110b4
SSDEEP

192:qA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:+R7SrtTv53tdtTgwF4SQbGPX36wJMw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1892	1448	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 2240 wrote to memory of 1448	2240	rundll32.exe	28
PID 1448 wrote to memory of 1892	1448	rundll32.exe	29
PID 1448 wrote to memory of 1892	1448	rundll32.exe	29
PID 1448 wrote to memory of 1892	1448	rundll32.exe	29
PID 1448 wrote to memory of 1892	1448	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 224
    3⤵
    - Program crash
    PID:1892