2254bb343c2cc8744503d4195617d470d343ae9e9fe242d7ebc1a7e720fb9225

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 03:52

Target

$PLUGINSDIR/utu.dll
Size

108KB
MD5

c682db5dd38efe982e120b6c7d2951cd
SHA1

27fd523ea4e9c74e6009ed51273fb5d7fa890bac
SHA256

1ee9aa15ec183ec4a6dcca145c0e76fb9eb33f80b96bc63efe99750f1618ffc1
SHA512

cde5b3ac50e709cd26986ccf2829df92a01d30bb48de5c3a1bbcdffd2ff9c1b68787278a36c54ff95d42e909c954406391171b93c6ecdc6a739454bdd4f7ba61
SSDEEP

1536:FoYJnpkyuwsit3yP6tV6svj8tfukHqRWaHUgVLSN1v9P+FXllUiB+gVNhtz:FoYJnpkycKyUX7XB29QXjUd2tz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
496	2812	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2952 wrote to memory of 2812	2952	rundll32.exe	28
PID 2812 wrote to memory of 496	2812	rundll32.exe	29
PID 2812 wrote to memory of 496	2812	rundll32.exe	29
PID 2812 wrote to memory of 496	2812	rundll32.exe	29
PID 2812 wrote to memory of 496	2812	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\utu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\utu.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 220
    3⤵
    - Program crash
    PID:496