3383e5ed89a4703ac88c7b8bfd322fb56d035e0dc4c9bb48be02b564e28d1818

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-03-2024 04:00

Target

$PLUGINSDIR/spdfabbx.dll
Size

105KB
MD5

a0f13c3729d70aa371add5038a1336fb
SHA1

c87d35c652abf87932fd9f1ba77ecc62e0a2281d
SHA256

03b50dc7cd5d915c6a19efd60a767fb3582913f23c231223fb6b44f7bde594b2
SHA512

09d2b2fd0dec0bf68a86bfeb4df9236dccf176f9135953984f5a69cd86b10001d3a71db30e09c6c91b20e561933574af2dbaf4bd406587b46b0c19630137be1c
SSDEEP

1536:wMUmgGAXhfejHsu0Oj0mSCeo/JJmwi0EpzRYAFV24kKnHjhPCkzue3Wkl/9ncobI:rUmgGAVesYtzlE59BHxl/r9pJ6e

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1496 544 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1496	544	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1796 wrote to memory of 544	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 544	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 544	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 544	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 544	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 544	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 544	1796	rundll32.exe	rundll32.exe
PID 544 wrote to memory of 1496	544	rundll32.exe	WerFault.exe
PID 544 wrote to memory of 1496	544	rundll32.exe	WerFault.exe
PID 544 wrote to memory of 1496	544	rundll32.exe	WerFault.exe
PID 544 wrote to memory of 1496	544	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\spdfabbx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\spdfabbx.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 276
3⤵
- Program crash
PID:1496