e907d2c7ba3274b072838089ea1039e925255e7bab7d94d696b33a5f8e9c0692

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 22:04

Target

$PLUGINSDIR/System.dll
Size

23KB
MD5

61dbd8a041e5f17d3bd2ad5279f3449d
SHA1

7953be26fa396bbb8571edf1c8d87680e33e7d97
SHA256

82a6c9a17ad368bcbd45e1705a0b57e3a415acc744d924818ef777e95910a680
SHA512

f805ec4587259b4d07c594fa7675571a3ed944bab2eecc877a744e74ac9a43a073543d165d7c94aca14d5c1f083dc8e72ce0beec65e0516a4fc0ae36d5de5069
SSDEEP

384:58PJlt70esj0Mt9vn6ay62HQIYiagle9qfvsAM+o/8E9VF0NyMyx:5+qesjRL6Z5Yide1AMxkEjx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2608	2728	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2728	2856	rundll32.exe	28
PID 2856 wrote to memory of 2728	2856	rundll32.exe	28
PID 2856 wrote to memory of 2728	2856	rundll32.exe	28
PID 2856 wrote to memory of 2728	2856	rundll32.exe	28
PID 2856 wrote to memory of 2728	2856	rundll32.exe	28
PID 2856 wrote to memory of 2728	2856	rundll32.exe	28
PID 2856 wrote to memory of 2728	2856	rundll32.exe	28
PID 2728 wrote to memory of 2608	2728	rundll32.exe	29
PID 2728 wrote to memory of 2608	2728	rundll32.exe	29
PID 2728 wrote to memory of 2608	2728	rundll32.exe	29
PID 2728 wrote to memory of 2608	2728	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 220
    3⤵
    - Program crash
    PID:2608