a944aede510112b275795e1ed178f7f9ad3d1835239c8518ec38f4b7eb59d22f

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 06:24

Target

$PLUGINSDIR/tmp1flsct.dll
Size

2.6MB
MD5

e6f399b01f56188ecb0ac79d39989bf9
SHA1

d4e4a1ff7ec6558f03a2ba19c06f6c5e7471691b
SHA256

aebf600d0056c2a0aab6e7b12ab6cbdb6a990edca79f602cd8bd042c0b73ab1c
SHA512

e28b582e0f697b873a6d4363af050364db94a7fbcd28d8cb09c2f14feaa9cd727c4947cfd5c4daa0065c3543d530156f30133db4dfab63b55c741f155337e59b
SSDEEP

24576:xTR6TNT2JWMvksem7K0yYy85FcXshq3q9Wsljz2:JLryc86q3qgJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	2900	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2872 wrote to memory of 2900	2872	rundll32.exe	28
PID 2900 wrote to memory of 3032	2900	rundll32.exe	29
PID 2900 wrote to memory of 3032	2900	rundll32.exe	29
PID 2900 wrote to memory of 3032	2900	rundll32.exe	29
PID 2900 wrote to memory of 3032	2900	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tmp1flsct.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tmp1flsct.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 272
    3⤵
    - Program crash
    PID:3032

memory/2900-1-0x0000000000420000-0x0000000000577000-memory.dmp

Filesize
1.3MB

Download