88c871fe1cae64d0a72103a3df002e9a192e6061f4f08eba3859c395abe948da

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 17:52

Target

$PLUGINSDIR/SimpleFC.dll
Size

175KB
MD5

941a7b4dc105c3487d2b2961dc6ccb01
SHA1

ac71c5b759cabd78213748329909eaee60810d12
SHA256

7274fe736fe36cdc8343b04fea6ff598ce384ead99ea94e4b47d4d329037331d
SHA512

40b2067121366254a6ff048e05767c337ea3f811122f97a5ce283502b6b6bba3eb82b2637115e65772c8b32c6c1a8cf9f991b06731bf7e71ffe5a6cf026ed5e6
SSDEEP

3072:l2sd6EP05etg+rKTTmYjcnPMdsRrdU+/mbM/AuaNoNglzppVn5OtcieI0Yr61u:Us4zIg+rKTTmnhfAoSxZ5O10a

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
268	2448	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2448	2452	rundll32.exe	28
PID 2452 wrote to memory of 2448	2452	rundll32.exe	28
PID 2452 wrote to memory of 2448	2452	rundll32.exe	28
PID 2452 wrote to memory of 2448	2452	rundll32.exe	28
PID 2452 wrote to memory of 2448	2452	rundll32.exe	28
PID 2452 wrote to memory of 2448	2452	rundll32.exe	28
PID 2452 wrote to memory of 2448	2452	rundll32.exe	28
PID 2448 wrote to memory of 268	2448	rundll32.exe	29
PID 2448 wrote to memory of 268	2448	rundll32.exe	29
PID 2448 wrote to memory of 268	2448	rundll32.exe	29
PID 2448 wrote to memory of 268	2448	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SimpleFC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SimpleFC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 244
    3⤵
    - Program crash
    PID:268

memory/2448-0-0x0000000000170000-0x00000000001A0000-memory.dmp

Filesize
192KB

Download
memory/2448-1-0x0000000000170000-0x00000000001A0000-memory.dmp

Filesize
192KB

Download