cf1df17c2105cf334c8e66dea374d34639ada4d4f51492a30901ab60591567ab

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 15:14

Target

$PLUGINSDIR/StartMenu.dll
Size

6KB
MD5

4221b986a7f977d3658b7ed994762796
SHA1

2d1455a73653e0449de7aa39a2d4c9bd5be8d2f7
SHA256

a7f9f6427cb8ecb308dfd2ac622168b73a605614a83b7a9f6e3d416e7e9061c8
SHA512

e37415ae4166c99995999cceefe2cade1c9f4e7950d61231acfd220fe30eabec4208ba2d2fcd4e363d2f5fcf84af127291412710f3767dfd29e25cfa4e571f09
SSDEEP

96:oLJdRZk8OkmE+WHw0FMXF6CWhFxKpKscQhEfP0:oLjPk8OT30FFAdCP0

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2196	2376	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 1936 wrote to memory of 2376	1936	rundll32.exe	28
PID 2376 wrote to memory of 2196	2376	rundll32.exe	29
PID 2376 wrote to memory of 2196	2376	rundll32.exe	29
PID 2376 wrote to memory of 2196	2376	rundll32.exe	29
PID 2376 wrote to memory of 2196	2376	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 224
    3⤵
    - Program crash
    PID:2196