88977075356dc9e4c81ff59e5ffc004ab3d62070c1062ce7b690a941d5328090

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 14:03

Target

$PLUGINSDIR/PCWPlugin.dll
Size

262KB
MD5

8240bee02c3ad64fe256a67479de886c
SHA1

afb6f7fede3ef1509b1be979dd3ca1ce5ea03db6
SHA256

d0a7db3315f28a3b1016b21a78d30b71d961b5979d50635c716df5c11fd1351e
SHA512

34170981f78f77814c6869f3833631726c869ddab28827260d3a9ab9fd9b899414f53a7c94517cf25afebb883e2638190c1b396259fead3cb3dc1f123b94ad33
SSDEEP

6144:NeQ5iCP1bcPhOYNKtZdTTitGM4GCbmwjl3Cf5d4EL:uUYNK1NM4Gfwjl3Cf5KE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	2348	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	rundll32.exe
Token: SeDebugPrivilege	2348	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2348	856	rundll32.exe	28
PID 856 wrote to memory of 2348	856	rundll32.exe	28
PID 856 wrote to memory of 2348	856	rundll32.exe	28
PID 856 wrote to memory of 2348	856	rundll32.exe	28
PID 856 wrote to memory of 2348	856	rundll32.exe	28
PID 856 wrote to memory of 2348	856	rundll32.exe	28
PID 856 wrote to memory of 2348	856	rundll32.exe	28
PID 2348 wrote to memory of 2272	2348	rundll32.exe	29
PID 2348 wrote to memory of 2272	2348	rundll32.exe	29
PID 2348 wrote to memory of 2272	2348	rundll32.exe	29
PID 2348 wrote to memory of 2272	2348	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PCWPlugin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PCWPlugin.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 384
    3⤵
    - Program crash
    PID:2272