27694908dbdcf9b68fe26c65140c22da7068c2ebd154db13d2eb1571f9153ede

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 21:15

Target

$PLUGINSDIR/CommonFuncDll.dll
Size

201KB
MD5

d62a1421c26f59015ede0f10638a7b1a
SHA1

bfbd19a256fc7f79b8089eacf22ff364116ede17
SHA256

ec88e41350b16456d299909040680d2a291f29da6f6ff8e8c5ef3bbfc355f45a
SHA512

9928ba693ddac2355399b3efcb4becef8fd6ef7cac7556d0bdc9d13fb4780f8246256a0df0c7406c05e090d718f92997f0b072162d9429b6a3021f81fe60f7cd
SSDEEP

3072:CyAyMR2mQrxPozIKljLkCKCoZyqf8xMnhTHL0pgDrtE2fo1h0My:C8O2zrxPoIgLLpqExOhTApgDrtxw16

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	1116	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1728 wrote to memory of 1116	1728	rundll32.exe	28
PID 1116 wrote to memory of 1448	1116	rundll32.exe	29
PID 1116 wrote to memory of 1448	1116	rundll32.exe	29
PID 1116 wrote to memory of 1448	1116	rundll32.exe	29
PID 1116 wrote to memory of 1448	1116	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CommonFuncDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CommonFuncDll.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 264
    3⤵
    - Program crash
    PID:1448