752fa6e4b62d30146d4639d84307a5cbbd74ef990305327cd15c7a6f070d53e4

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 10:14

Target

$PLUGINSDIR/Dialer.dll
Size

3KB
MD5

18adbaf253b4483e59a94be06a9135e9
SHA1

e096e87c93c80077d9726a585e52af2d46fa61ec
SHA256

62f01d82e12633f1aa677a6c8c2e34316ab422d240179d8bac8ce6582f84f6f4
SHA512

2ec8ef2486f631e63ab357420535eca64f7d7c369988967fe46adf58a6f12944de385b8002436b1ddc1e88cbc6968c6981caa0bb10168a073644fd9c2ec87f83

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2224	1840	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 1840	2904	rundll32.exe	28
PID 2904 wrote to memory of 1840	2904	rundll32.exe	28
PID 2904 wrote to memory of 1840	2904	rundll32.exe	28
PID 2904 wrote to memory of 1840	2904	rundll32.exe	28
PID 2904 wrote to memory of 1840	2904	rundll32.exe	28
PID 2904 wrote to memory of 1840	2904	rundll32.exe	28
PID 2904 wrote to memory of 1840	2904	rundll32.exe	28
PID 1840 wrote to memory of 2224	1840	rundll32.exe	29
PID 1840 wrote to memory of 2224	1840	rundll32.exe	29
PID 1840 wrote to memory of 2224	1840	rundll32.exe	29
PID 1840 wrote to memory of 2224	1840	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Dialer.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 228
    3⤵
    - Program crash
    PID:2224