9b304dad1b14ad0e6b1205eab205470b5467aad50da89958e4c4954ea36979e0

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 08:19

Target

$PLUGINSDIR/forwi.dll
Size

120KB
MD5

dc42cbe414856ab1675a783baa1d1d2e
SHA1

571e4eef179021bc1c9951378ab9994a1b5db244
SHA256

cf99480981732b5a18231bb26a245707396adb5ee9a120c2ce6fecedba693538
SHA512

8066ca01c678458cfede4709339b2006d4fad9a9e522f0d36c24c16aa24e05720e15ff12a19fb0ca7d830a6e6bbfefb9ae298f40602e17d039cc3c7a1b61b788
SSDEEP

1536:yL63YAZ8HYSipNXE9EZrlmZbeBpXdRNLNgDVqWnwBjjZQ4MSv:yLf94SifOZQ5ADVqvjjZQjS

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2188	3048	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 3048	1204	rundll32.exe	28
PID 1204 wrote to memory of 3048	1204	rundll32.exe	28
PID 1204 wrote to memory of 3048	1204	rundll32.exe	28
PID 1204 wrote to memory of 3048	1204	rundll32.exe	28
PID 1204 wrote to memory of 3048	1204	rundll32.exe	28
PID 1204 wrote to memory of 3048	1204	rundll32.exe	28
PID 1204 wrote to memory of 3048	1204	rundll32.exe	28
PID 3048 wrote to memory of 2188	3048	rundll32.exe	29
PID 3048 wrote to memory of 2188	3048	rundll32.exe	29
PID 3048 wrote to memory of 2188	3048	rundll32.exe	29
PID 3048 wrote to memory of 2188	3048	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\forwi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\forwi.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 220
    3⤵
    - Program crash
    PID:2188