4fb3b4a9b098c5c60d7887df0598a6f98c61e90d4a9b2dec1220cbbfd9f2ccc0

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 21:48

Target

$PLUGINSDIR/AccessControl.dll
Size

14KB
MD5

b9f48a4c97828f4db8a9b727d6df8dc7
SHA1

9ee2ac111560a5bb6e3377297dc93edb2f16ef8a
SHA256

273fe91103597f3ae0cd750e4b52bd83a9d582f90224d6e539e1a95a7481b71f
SHA512

6c8fc6372210da16fb5a2f88427b75eccdad3c8c930822f647245988d88ce34bde835fb1458415bdac297fda766bcf4d4e1feda00216a70bc0cfb44b75e1aa83
SSDEEP

192:TNzPKgdc4SN+XIjjAZaZp26N6dlJmclFFwmyywXhdMywUixm5:TNzPM0/aZUFFw1ysBZis

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2820	2060	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2060	2516	rundll32.exe	28
PID 2516 wrote to memory of 2060	2516	rundll32.exe	28
PID 2516 wrote to memory of 2060	2516	rundll32.exe	28
PID 2516 wrote to memory of 2060	2516	rundll32.exe	28
PID 2516 wrote to memory of 2060	2516	rundll32.exe	28
PID 2516 wrote to memory of 2060	2516	rundll32.exe	28
PID 2516 wrote to memory of 2060	2516	rundll32.exe	28
PID 2060 wrote to memory of 2820	2060	rundll32.exe	29
PID 2060 wrote to memory of 2820	2060	rundll32.exe	29
PID 2060 wrote to memory of 2820	2060	rundll32.exe	29
PID 2060 wrote to memory of 2820	2060	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AccessControl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AccessControl.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 220
    3⤵
    - Program crash
    PID:2820