76dc9781cba6d404b709f3b50f6d1fc4a9028ed13bb44df20fee6aa97429e759

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 18:02

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

593345196fcd1c553b0702cc026ccccd
SHA1

84446849c10e0c4d6683072f4c2eea5a085bac2f
SHA256

fb4a4bea088b8dbf2adda6fdeb50be4b96bf20ba62bd9ac64b68ea628166a28d
SHA512

b28da01bec7a34a493316606c7406c06d0b278f1318563874f037caf203c2ec261c3f5c2a1790c6c177537bbb0f4dd0b7be482976f7114f70be75b5e4b311306

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1592	2200	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2200	2172	rundll32.exe	28
PID 2172 wrote to memory of 2200	2172	rundll32.exe	28
PID 2172 wrote to memory of 2200	2172	rundll32.exe	28
PID 2172 wrote to memory of 2200	2172	rundll32.exe	28
PID 2172 wrote to memory of 2200	2172	rundll32.exe	28
PID 2172 wrote to memory of 2200	2172	rundll32.exe	28
PID 2172 wrote to memory of 2200	2172	rundll32.exe	28
PID 2200 wrote to memory of 1592	2200	rundll32.exe	29
PID 2200 wrote to memory of 1592	2200	rundll32.exe	29
PID 2200 wrote to memory of 1592	2200	rundll32.exe	29
PID 2200 wrote to memory of 1592	2200	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2200 -s 224
    3⤵
    - Program crash
    PID:1592