284a18ed393b0e60ca6fada933c6612df9862d024038c51a0ab8906ccbdcc990

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 07:47

Target

$PLUGINSDIR/Internet.dll
Size

10KB
MD5

d4d774e8cf4c2dc669f4f2003334ccf4
SHA1

3759ad7e7195c40836e4a465b2db7749673a5a1d
SHA256

04c22ec18d614a76181709482a7307b2e59d4c45f42bf1f6313a974982e519be
SHA512

bb4898a1c457faf8b7a711c6040c959b1d8361b4dab758283c1f531d4155803f2a6fa3bd57cf8490cbec98499738deaa830dc44e0067d3da8970e34bee2d453e
SSDEEP

192:PLfR+vHCJ1oKnYe+PjPSrcy++v1Etr9ZCspE+TMQrFW:FmCznYPLltAeMh

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1992	2380	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2380	1724	rundll32.exe	28
PID 1724 wrote to memory of 2380	1724	rundll32.exe	28
PID 1724 wrote to memory of 2380	1724	rundll32.exe	28
PID 1724 wrote to memory of 2380	1724	rundll32.exe	28
PID 1724 wrote to memory of 2380	1724	rundll32.exe	28
PID 1724 wrote to memory of 2380	1724	rundll32.exe	28
PID 1724 wrote to memory of 2380	1724	rundll32.exe	28
PID 2380 wrote to memory of 1992	2380	rundll32.exe	29
PID 2380 wrote to memory of 1992	2380	rundll32.exe	29
PID 2380 wrote to memory of 1992	2380	rundll32.exe	29
PID 2380 wrote to memory of 1992	2380	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Internet.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Internet.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 232
    3⤵
    - Program crash
    PID:1992