27694908dbdcf9b68fe26c65140c22da7068c2ebd154db13d2eb1571f9153ede

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 21:15

Target

$PLUGINSDIR/System.dll
Size

16KB
MD5

f2ef25e73f310d16ddaff081659bd0eb
SHA1

c41606a6cae0b3b358fb53aece08093a47b6f1bf
SHA256

bd73601f5f1dd47b857cc3194293b1cd33cdb93c32bd05535e9328cede6b2e06
SHA512

7b62456646c7637c300638d26df7f43ffdcf1b88a631f50390cb9b2ac6349a90c096eca7795045891815d4fbaa6d7b0c1f2abedf989f6e990b092a1ca4d340f1
SSDEEP

384:/ViJrtFRdbmXK8+PCwct3mirILxi9heM3:/VafbmXKXqwpIILkH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1656	1120	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 2156 wrote to memory of 1120	2156	rundll32.exe	28
PID 1120 wrote to memory of 1656	1120	rundll32.exe	29
PID 1120 wrote to memory of 1656	1120	rundll32.exe	29
PID 1120 wrote to memory of 1656	1120	rundll32.exe	29
PID 1120 wrote to memory of 1656	1120	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 224
    3⤵
    - Program crash
    PID:1656