27694908dbdcf9b68fe26c65140c22da7068c2ebd154db13d2eb1571f9153ede

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 21:15

Target

$PLUGINSDIR/PPLMessageBox.dll
Size

45KB
MD5

b4198cb6e7271852d7b8b3260161a20b
SHA1

83f126b717389a51a4c4a4c6679043abad0d82ab
SHA256

40cb0cd0eb4067102f01bd6e6d0019b716ec0d0a470b12a9201cccd2488257f3
SHA512

6ea92ac39ad3bf36d7cc4c4ca2d0d3dc9aa4dc313a638c691f6b5da9c8c35057a49034ff2558d3cdde0fedee1612a5b7049f1f7be3172bf97c0f3415922f99cd
SSDEEP

768:UBjBr8enoRHWhXNYFYk3t2uda3CVLWQbC6:0Br8GoRHWhXiakouI3CVaEC6

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1468	1704	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1704	756	rundll32.exe	28
PID 756 wrote to memory of 1704	756	rundll32.exe	28
PID 756 wrote to memory of 1704	756	rundll32.exe	28
PID 756 wrote to memory of 1704	756	rundll32.exe	28
PID 756 wrote to memory of 1704	756	rundll32.exe	28
PID 756 wrote to memory of 1704	756	rundll32.exe	28
PID 756 wrote to memory of 1704	756	rundll32.exe	28
PID 1704 wrote to memory of 1468	1704	rundll32.exe	29
PID 1704 wrote to memory of 1468	1704	rundll32.exe	29
PID 1704 wrote to memory of 1468	1704	rundll32.exe	29
PID 1704 wrote to memory of 1468	1704	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PPLMessageBox.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PPLMessageBox.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 236
    3⤵
    - Program crash
    PID:1468