e28bcb78e966081d32fedc3cc0b8e3c272edbb82933f4aeb4fa28b626820d6bb

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 09:22

Target

$PLUGINSDIR/CustomInetc.dll
Size

21KB
MD5

81e20eb6c3a6002a805265ca751c7217
SHA1

db0e645b6d22b77b4117fb5612a0bf83c613c199
SHA256

3c0d6c3ee0784b2f10093a927335382f67050156136991f0ae05fa4484bab8f4
SHA512

ae6b594bd6cb42913484b5c5282757a9e8f52e76647bf3ef49555c2080540be683079f7994050a7baa45f7a2f57441fcd23353f351476f2891912ec5d2bfc2cf
SSDEEP

384:96WBKKhxKPJeXt0OxyfWB9VTZVWav3ARHKpK/V3STMvDya4m0Ac9khYLMkIX0+Gg:99nKPZfUZVzv3ARHKwhSYvWa4uL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2244	2096	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2096	2748	rundll32.exe	28
PID 2748 wrote to memory of 2096	2748	rundll32.exe	28
PID 2748 wrote to memory of 2096	2748	rundll32.exe	28
PID 2748 wrote to memory of 2096	2748	rundll32.exe	28
PID 2748 wrote to memory of 2096	2748	rundll32.exe	28
PID 2748 wrote to memory of 2096	2748	rundll32.exe	28
PID 2748 wrote to memory of 2096	2748	rundll32.exe	28
PID 2096 wrote to memory of 2244	2096	rundll32.exe	29
PID 2096 wrote to memory of 2244	2096	rundll32.exe	29
PID 2096 wrote to memory of 2244	2096	rundll32.exe	29
PID 2096 wrote to memory of 2244	2096	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CustomInetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CustomInetc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 240
    3⤵
    - Program crash
    PID:2244