75ff6072436c6bf42b8bac92bdb5127f2000032d856b0a67266048cc090ef11a

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:10

Target

$PLUGINSDIR/ihctsns.dll
Size

166KB
MD5

9915ed630811790c76c5f9498b982f6a
SHA1

3eee156a20836066056d4dfdd8e320ce524e53e1
SHA256

7203d9a21f1d5abab705f3d42f2b64c887b5355fd9e3b28e3e6dd16d67ade8b1
SHA512

a9581cf3ba9800c6508d77603bdd27cbb6b0021c8423df078912fb6107f4f9914b53e666e97616039be8bda21789fc02c944390fe7700894d5348cc770d3016d
SSDEEP

3072:GtgbOzZITn1iqap0/KTgl5sdMldwTro+qe9spY6al:egbOzS71iPslddwTM27l

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

820 2092 WerFault.exe rundll32.exe

pid	pid_target	process	target process
820	2092	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2992 wrote to memory of 2092	2992	rundll32.exe	rundll32.exe
PID 2092 wrote to memory of 820	2092	rundll32.exe	WerFault.exe
PID 2092 wrote to memory of 820	2092	rundll32.exe	WerFault.exe
PID 2092 wrote to memory of 820	2092	rundll32.exe	WerFault.exe
PID 2092 wrote to memory of 820	2092	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ihctsns.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ihctsns.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 220
    3⤵
    - Program crash
    PID:820