c41ec3a9224a131c1e118fb6927ce73ad0c64bb66b727fe185f1eb114a8f8129

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 14:46

Target

$PLUGINSDIR/inetcEXT.dll
Size

21KB
MD5

637d9bb78822a42ede890102065892ed
SHA1

6221e648833aaf3bf57915dd7fd811cedfcd81b0
SHA256

5303825e1eee6780cfc3571bb0705b5cf295a07cf34ab360db77d21a2dc0d722
SHA512

a1216ae15fce8e7bf99701cac145e3e036c6c03c8e38b1256610b6f43eb4d724225dc938cca26c3989cbdf14bb9450250beafb88687ac6215336937f6a99d456
SSDEEP

384:qolst5Gsi/Vne0sCl3AREGraXLyk4UX0Ac9khYLMkIX0+GR9yjn:qow5UVnzBAdk+k4U

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	2320	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2908 wrote to memory of 2320	2908	rundll32.exe	28
PID 2320 wrote to memory of 2604	2320	rundll32.exe	29
PID 2320 wrote to memory of 2604	2320	rundll32.exe	29
PID 2320 wrote to memory of 2604	2320	rundll32.exe	29
PID 2320 wrote to memory of 2604	2320	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetcEXT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetcEXT.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 236
    3⤵
    - Program crash
    PID:2604