f4ed82101d7f7ba519079ea91d3a4c18d974d72ccc0dd63747c33b0aeedb82b9

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/04/2024, 03:16

Target

$PLUGINSDIR/CallAnsiPlugin.dll
Size

3KB
MD5

c8ff7c87b591958cb1970a7d89b9839f
SHA1

9d34a40b574eabd6bd321c976a13ab0f4d0ef236
SHA256

2703314a0d03377c6774dad865c292d4808bc4f748871f16f142c09527c5e617
SHA512

30a0cbefced3d1d044067e188fedb1137b1734c237ed9ffe52c009c46600ec081610e2e861074eacd5bb6252e20136bd13a800ce5704b39d2978571766dec13f

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3008	2076	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2076	2744	rundll32.exe	28
PID 2744 wrote to memory of 2076	2744	rundll32.exe	28
PID 2744 wrote to memory of 2076	2744	rundll32.exe	28
PID 2744 wrote to memory of 2076	2744	rundll32.exe	28
PID 2744 wrote to memory of 2076	2744	rundll32.exe	28
PID 2744 wrote to memory of 2076	2744	rundll32.exe	28
PID 2744 wrote to memory of 2076	2744	rundll32.exe	28
PID 2076 wrote to memory of 3008	2076	rundll32.exe	29
PID 2076 wrote to memory of 3008	2076	rundll32.exe	29
PID 2076 wrote to memory of 3008	2076	rundll32.exe	29
PID 2076 wrote to memory of 3008	2076	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CallAnsiPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CallAnsiPlugin.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 228
    3⤵
    - Program crash
    PID:3008