d11ecfdc1f5d350ff4ff2d1aa08d4e72b0eb424203aee450d39a63c21e489146

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 13:12

Target

$PLUGINSDIR/inetc.dll
Size

20KB
MD5

4c01fdfd2b57b32046b3b3635a4f4df8
SHA1

e0af8e418cbe2b2783b5de93279a3b5dcb73490e
SHA256

b98e21645910f82b328f30c644b86c112969b42697e797671647b09eb40ad014
SHA512

cbd354536e2a970d31ba69024208673b1dc56603ad604ff17c5840b4371958fc22bafd90040ae3fb19ae9c248b2cfce08d0bc73cc93481f02c73b86dbc0697b2
SSDEEP

384:rJBJ8VnX8K+uKn2WQJdxbs3aEUhU7ya4L60Ac9khYLMkIX0+GwNyEAG:3J8+K+uK2WQJdxbsqEUhUua4L6AG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2252 2424 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2252	2424	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2204 wrote to memory of 2424	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2424	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2424	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2424	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2424	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2424	2204	rundll32.exe	rundll32.exe
PID 2204 wrote to memory of 2424	2204	rundll32.exe	rundll32.exe
PID 2424 wrote to memory of 2252	2424	rundll32.exe	WerFault.exe
PID 2424 wrote to memory of 2252	2424	rundll32.exe	WerFault.exe
PID 2424 wrote to memory of 2252	2424	rundll32.exe	WerFault.exe
PID 2424 wrote to memory of 2252	2424	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 236
3⤵
- Program crash
PID:2252