469c034a1b0db632b355417177df3872abd056bd300ac457fae4ed4d9cb2ce8b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 16:06

Target

$PLUGINSDIR/ExLicenseIDBoanPage.dll
Size

44KB
MD5

96869afd6fae4c8ccb0c56996b8fae8d
SHA1

e9f4d80f61521b03d0c07d9abe3a00ff461de40b
SHA256

94bc2f57d978a4027c32595a1a3c5ed20f83d689646f254a4b2a5b815cee59d1
SHA512

12dacdab1e73e827f9507eaa963a012fa66a63b5a531e09f0bd84c4d81787e1777b347e325b6b4ae9fa11555ee390312173bc292860f6e234ecf3835a6a37b11
SSDEEP

384:Sum13eB6kWUnHOII9p8+6P95H282nv2JKiXn5IODyOx:Zkm6kxHOIIT8LWqHWO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1036	2200	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2356 wrote to memory of 2200	2356	rundll32.exe	28
PID 2200 wrote to memory of 1036	2200	rundll32.exe	29
PID 2200 wrote to memory of 1036	2200	rundll32.exe	29
PID 2200 wrote to memory of 1036	2200	rundll32.exe	29
PID 2200 wrote to memory of 1036	2200	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExLicenseIDBoanPage.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExLicenseIDBoanPage.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 244
    3⤵
    - Program crash
    PID:1036