27694908dbdcf9b68fe26c65140c22da7068c2ebd154db13d2eb1571f9153ede

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 21:15

Target

$PLUGINSDIR/PictureWindow.dll
Size

45KB
MD5

7c9499d5c444fde76e2dc05023c54925
SHA1

6c1e97042638fa44ecfad286a0bfc45f8133f4f2
SHA256

1449b163e6f5a9723d27ddfdfa9745ecdd90eafae7315981ce0842906cf3f1e9
SHA512

b75093db490cfa0a5a7a04c67f194bc79ea493625f98c99ccb5d0b703ac42035e5ce4b8159381e1852c6d27882ffa0ac46d897983322011a6322c81e96f0477b
SSDEEP

384:aSbkWAd6jiaQid8iJqnTkvYsNZ9QdTRsFw3TzW8YJLu18TbCyK:aAkAiaQid8iJ1Q8Z9Q0FqziLWQbCz

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3020	2964	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2964	2952	rundll32.exe	28
PID 2952 wrote to memory of 2964	2952	rundll32.exe	28
PID 2952 wrote to memory of 2964	2952	rundll32.exe	28
PID 2952 wrote to memory of 2964	2952	rundll32.exe	28
PID 2952 wrote to memory of 2964	2952	rundll32.exe	28
PID 2952 wrote to memory of 2964	2952	rundll32.exe	28
PID 2952 wrote to memory of 2964	2952	rundll32.exe	28
PID 2964 wrote to memory of 3020	2964	rundll32.exe	29
PID 2964 wrote to memory of 3020	2964	rundll32.exe	29
PID 2964 wrote to memory of 3020	2964	rundll32.exe	29
PID 2964 wrote to memory of 3020	2964	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PictureWindow.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\PictureWindow.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 244
    3⤵
    - Program crash
    PID:3020