3f9b4dca68a3211b84335bea3dea651cc6ae2b3fcfaaca057debac69f4223f69

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 00:49

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

1178db8f35343834993d79887aa12350
SHA1

dab6309d66b84b6656c12c83aa8506f1c10b5e09
SHA256

6f64f1311a633ce83abd6f9e08dea53ba8836fb7239f889a7a74e80d70f48b87
SHA512

45196d63701037bcf55e0801f6d027844037cc799dbc847be579a04db0bb522e4c7c85b89a7ad15a5b0cf4d7d9d306fa3a36515bc554dde9cf1e82fbff0ad24d

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2316	1620	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1712 wrote to memory of 1620	1712	rundll32.exe	28
PID 1620 wrote to memory of 2316	1620	rundll32.exe	29
PID 1620 wrote to memory of 2316	1620	rundll32.exe	29
PID 1620 wrote to memory of 2316	1620	rundll32.exe	29
PID 1620 wrote to memory of 2316	1620	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 224
    3⤵
    - Program crash
    PID:2316