e5a4f00a5050fd2f029b4bacba9fc79c65e8f74809ee53eda02e2059352811d7

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 00:59

Target

$PLUGINSDIR/StartMenu.dll
Size

8KB
MD5

be6fb713850c99b7cb365269779b7e70
SHA1

9e4eea2899afb5de0369ac1010d9e97c3a7d2bef
SHA256

0196ce26fc92791b88305cc4bd1d2838fd5c63abae21612423c80345e2c7b59e
SHA512

27c4c6382fa01e94d95cdd2892773d525bc328f4589ac251b1c90869a884a6f7514e2b638ff6b998d82979f9a4e7f99617853d48bf415749058482d42df529c7
SSDEEP

96:60chlULaycj0lhQt14glcjkAJ7uP2uPbsxwHoePRpfb:lvc11rc75VxMoI3f

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	1668	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 1668	2388	rundll32.exe	28
PID 2388 wrote to memory of 1668	2388	rundll32.exe	28
PID 2388 wrote to memory of 1668	2388	rundll32.exe	28
PID 2388 wrote to memory of 1668	2388	rundll32.exe	28
PID 2388 wrote to memory of 1668	2388	rundll32.exe	28
PID 2388 wrote to memory of 1668	2388	rundll32.exe	28
PID 2388 wrote to memory of 1668	2388	rundll32.exe	28
PID 1668 wrote to memory of 1672	1668	rundll32.exe	29
PID 1668 wrote to memory of 1672	1668	rundll32.exe	29
PID 1668 wrote to memory of 1672	1668	rundll32.exe	29
PID 1668 wrote to memory of 1672	1668	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 224
    3⤵
    - Program crash
    PID:1672

memory/1668-0-0x000000006D040000-0x000000006D049000-memory.dmp

Filesize
36KB

Download