90263f5e0ceee73af6ee6ca4dac8e6441c1f5c39607512a954e42887a5a0bb3a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 10:42

Target
$PLUGINSDIR/System.dll
Size 11KB
Sample240511-mrr8msfg35
SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
MD5 7399323923e3946fe9140132ac388132
SHA1 728257d06c452449b1241769b459f091aabcffc5
SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
308	820	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	28
PID 820 wrote to memory of 308	820	rundll32.exe	29
PID 820 wrote to memory of 308	820	rundll32.exe	29
PID 820 wrote to memory of 308	820	rundll32.exe	29
PID 820 wrote to memory of 308	820	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 224
    3⤵
    - Program crash
    PID:308