79551a4bc7453a47bf6ecabe218c80f7d8d57bb41a9900541d86d990b5cc8188

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 16:24

Target

$PLUGINSDIR/PictureWindow.dll
Size

46KB
MD5

28dd6576acf4b9ecdf7ce40844e00e82
SHA1

0d2416235f377e0afee423d32061c555ac728da8
SHA256

18e088d260b7e0032b176f8b3979b1e721f44b11c08ebf16c8073a1bf42f9d09
SHA512

06df7675def856acc051f95d31ea90a06ccf43c663cd4cd4a6c5824e4cdb2ceaf8c686ca3995fdacc1107b8c517236627471e0934412462670e49f29e0f2d063
SSDEEP

384:xQrfTJuM2VpBPwUUcN63RBUwcZ18rVjLjHSjQd94CB8FwkMnYPLVi9heMM:wfNZ2dYU30wrUrBLujQnPeF3MBc

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2108	1100	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1100	1084	rundll32.exe	28
PID 1084 wrote to memory of 1100	1084	rundll32.exe	28
PID 1084 wrote to memory of 1100	1084	rundll32.exe	28
PID 1084 wrote to memory of 1100	1084	rundll32.exe	28
PID 1084 wrote to memory of 1100	1084	rundll32.exe	28
PID 1084 wrote to memory of 1100	1084	rundll32.exe	28
PID 1084 wrote to memory of 1100	1084	rundll32.exe	28
PID 1100 wrote to memory of 2108	1100	rundll32.exe	29
PID 1100 wrote to memory of 2108	1100	rundll32.exe	29
PID 1100 wrote to memory of 2108	1100	rundll32.exe	29
PID 1100 wrote to memory of 2108	1100	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PictureWindow.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PictureWindow.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 252
    3⤵
    - Program crash
    PID:2108