00a1f3f97a7d6f9ade141fe21dc39c20cc2da58c15010a1cdb0d3a7831a577a2

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/04/2024, 22:31

Target
$PLUGINSDIR/StartMenu.dll
Size 7KB
Sample240407-2fqb8sgf66
SHA256 7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
MD5 a4173b381625f9f12aadb4e1cdaefdb8
SHA1 cf1680c2bc970d5675adbf5e89292a97e6724713
SHA512 fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
SSDEEP 96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	2984	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2984	2908	rundll32.exe	28
PID 2908 wrote to memory of 2984	2908	rundll32.exe	28
PID 2908 wrote to memory of 2984	2908	rundll32.exe	28
PID 2908 wrote to memory of 2984	2908	rundll32.exe	28
PID 2908 wrote to memory of 2984	2908	rundll32.exe	28
PID 2908 wrote to memory of 2984	2908	rundll32.exe	28
PID 2908 wrote to memory of 2984	2908	rundll32.exe	28
PID 2984 wrote to memory of 3004	2984	rundll32.exe	29
PID 2984 wrote to memory of 3004	2984	rundll32.exe	29
PID 2984 wrote to memory of 3004	2984	rundll32.exe	29
PID 2984 wrote to memory of 3004	2984	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 228
    3⤵
    - Program crash
    PID:3004