10914bccd80e9f3e92eb35be5830a92462fa01d8b820f3e55dab054e432a3f26

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 23:34

Target

$PLUGINSDIR/mmj.dll
Size

107KB
MD5

00fef6fa1709a58f5b6de7f2e05bdadf
SHA1

08266cb5d4a93cb26503c43081bb803b7277c9bb
SHA256

2f826fee0b368544853eb8e17904535b172db34f475d2187b15a96c2aa273337
SHA512

4e8730bea893b7f69eb8e264186071fad1b1516e164c93b52206da589f95e920427c9ae7dd226df5efc7f8934de5b58be456e55af9d396932287cc0e95dc21be
SSDEEP

1536:BB90wgIuSssxcbmhHqTUxouw+nxLwWLoelSm4X+Mmb9hw9gJMffi:BB2Eu6Y2xtvx09GSm4uD9hmgJQK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1692	1520	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1520	2348	rundll32.exe	28
PID 2348 wrote to memory of 1520	2348	rundll32.exe	28
PID 2348 wrote to memory of 1520	2348	rundll32.exe	28
PID 2348 wrote to memory of 1520	2348	rundll32.exe	28
PID 2348 wrote to memory of 1520	2348	rundll32.exe	28
PID 2348 wrote to memory of 1520	2348	rundll32.exe	28
PID 2348 wrote to memory of 1520	2348	rundll32.exe	28
PID 1520 wrote to memory of 1692	1520	rundll32.exe	29
PID 1520 wrote to memory of 1692	1520	rundll32.exe	29
PID 1520 wrote to memory of 1692	1520	rundll32.exe	29
PID 1520 wrote to memory of 1692	1520	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mmj.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\mmj.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 220
    3⤵
    - Program crash
    PID:1692