9df5b721c2d81e174c49a5f39be74fe761d0403e184a2f2a079aca427f2e0124

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 05:19

Target

$PLUGINSDIR/Convert.dll
Size

113KB
MD5

27ad43a37566f883c2a95f773dd3b6f5
SHA1

0c5ab78b2fc5de9b789c0051b2eb5b3f82b83af1
SHA256

acaae5a76974ca7f8d7544104fb8398c4075baed7920e356988ef177055a905f
SHA512

4397842f5162a19aa420d7cd0c299896d78d4d8ab90044c10e3aee234fc5b787b399bff286ac9cca693e99f4170cafb36cb00f646869ab949d2854cb8ec72d4d
SSDEEP

1536:Txzd/P79Tzw2DtmHY72aD8c8ngWnij1/O1n+mW8Bf4FUImE:9BBUBHyuc8gjin+t8BwFUbE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2076	2940	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2940	2240	rundll32.exe	28
PID 2240 wrote to memory of 2940	2240	rundll32.exe	28
PID 2240 wrote to memory of 2940	2240	rundll32.exe	28
PID 2240 wrote to memory of 2940	2240	rundll32.exe	28
PID 2240 wrote to memory of 2940	2240	rundll32.exe	28
PID 2240 wrote to memory of 2940	2240	rundll32.exe	28
PID 2240 wrote to memory of 2940	2240	rundll32.exe	28
PID 2940 wrote to memory of 2076	2940	rundll32.exe	29
PID 2940 wrote to memory of 2076	2940	rundll32.exe	29
PID 2940 wrote to memory of 2076	2940	rundll32.exe	29
PID 2940 wrote to memory of 2076	2940	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Convert.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Convert.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 220
    3⤵
    - Program crash
    PID:2076