cd0fed0b2f7dd886deae0f349672a465fa91c68673c0c6ca7b98bc2734b68728

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 00:12

Target

$PLUGINSDIR/chrmPref.dll
Size

208KB
MD5

b2bff24dcb4606c6c8474f979bfb4858
SHA1

5671b867df8ce726d1075909cd40f3934d680da6
SHA256

82d89574b1019c60d6bcf97318b36f8e4bb535bb68334c68253b6306d9dbe4af
SHA512

e7187607c909a9416ede056c10e83d4a0b8f8bb33a8653009630d5f36f80c8be145658d1c2d9df3ede48ce1e9bdf20d192dff45ebe0c6fdc50f241e81df4c874
SSDEEP

3072:R09yocgUKjfjp0CF45n1FAFbqz2Yoz+wThF4hW0OJ5XR+LbA1p5oonej12lS:R0MpgUWfFg4Fbc+ThihW55XiA1bW

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2352 1704 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2352	1704	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2232 wrote to memory of 1704	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1704	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1704	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1704	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1704	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1704	2232	rundll32.exe	rundll32.exe
PID 2232 wrote to memory of 1704	2232	rundll32.exe	rundll32.exe
PID 1704 wrote to memory of 2352	1704	rundll32.exe	WerFault.exe
PID 1704 wrote to memory of 2352	1704	rundll32.exe	WerFault.exe
PID 1704 wrote to memory of 2352	1704	rundll32.exe	WerFault.exe
PID 1704 wrote to memory of 2352	1704	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\chrmPref.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\chrmPref.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 224
3⤵
- Program crash
PID:2352