4de22f65551da53a761b1e9049abfcfdeddb4f36dfd50503f4ac45a0e4f972a4

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 13:05

Target

$PLUGINSDIR/WmiInspector.dll
Size

78KB
MD5

b757cd400e19c6722e721e27a6db1cfd
SHA1

2e07f3a7b036c3c263049af483721f88ecdb2c53
SHA256

26c8981d7e3cd8093c40bb7da0c045e89f6dfc1a0888efaac9e22a555d763142
SHA512

9e4675f380d7b79ac0c2f59c8b38663710798f8ee19233aabbd9f5ba81b74901c4f7c0e3d982ccca640ca240b631f889daad27160d3456ed7bb66ffe68e29e72
SSDEEP

1536:0o0RUqYnecKBiygONayX2PYnyBN1yksAPvTbhKJB:0/LZiCwyCVPnhM

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2744	2504	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2504	1308	rundll32.exe	28
PID 1308 wrote to memory of 2504	1308	rundll32.exe	28
PID 1308 wrote to memory of 2504	1308	rundll32.exe	28
PID 1308 wrote to memory of 2504	1308	rundll32.exe	28
PID 1308 wrote to memory of 2504	1308	rundll32.exe	28
PID 1308 wrote to memory of 2504	1308	rundll32.exe	28
PID 1308 wrote to memory of 2504	1308	rundll32.exe	28
PID 2504 wrote to memory of 2744	2504	rundll32.exe	29
PID 2504 wrote to memory of 2744	2504	rundll32.exe	29
PID 2504 wrote to memory of 2744	2504	rundll32.exe	29
PID 2504 wrote to memory of 2744	2504	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WmiInspector.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WmiInspector.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 224
    3⤵
    - Program crash
    PID:2744