dbdc4bbf70c2c98f63488758b63677bee47f87423efddab8b550b386a946355f

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 17:23

Target

$PLUGINSDIR/ApplicationID.dll
Size

52KB
MD5

b5d63240d145cef5a226a757bcb9cfa4
SHA1

043e7d43b74a71bb1f7ea7a8cccf2150879babe8
SHA256

096e40b3fd5803f323660b2687946d4d6ad004e84b27ab67d4f60707358ee375
SHA512

c67f4bebdb906cb30b9cbac02a3ca3d06d74d0a4d9f580873242059a7102b278dba2af7b4bbcb728b3dcc40396d56e5bc9aa68485b3657465e173a54666fa1ae
SSDEEP

384:Gubd5EUwI12n3t7LgbpbnGRemovGQLRQnM7zvnPjRFgiNrTU77eu7Ix1xPW+hLWD:/bd5EUMtgbnmMG0vvPZ5ki6YPW+hTL

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1708 2264 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1708	2264	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2248 wrote to memory of 2264	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2264	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2264	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2264	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2264	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2264	2248	rundll32.exe	rundll32.exe
PID 2248 wrote to memory of 2264	2248	rundll32.exe	rundll32.exe
PID 2264 wrote to memory of 1708	2264	rundll32.exe	WerFault.exe
PID 2264 wrote to memory of 1708	2264	rundll32.exe	WerFault.exe
PID 2264 wrote to memory of 1708	2264	rundll32.exe	WerFault.exe
PID 2264 wrote to memory of 1708	2264	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ApplicationID.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ApplicationID.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 224
3⤵
- Program crash
PID:1708