16b6f6d90d3660f8adc39145ac20c2089ea376f9861f24d1925063f4aece2a22

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 11:53

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

dada3e1836af78d5b24499da252d01e4
SHA1

d2a1c25405e3c74973cf18dec2c7138df9e96a83
SHA256

0073337816509851476c2cc154f471a3e3a1a2806b97c363870acc09a30a5ed7
SHA512

f8bda8413dadb00a644341da5e076f203a3134daaefd2961fa0341f5a533eee28582ce9872354ead698bb1275ee7726fa574267e909a3e2f977908392e7a5c66

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2988	2680	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2680	1636	rundll32.exe	28
PID 1636 wrote to memory of 2680	1636	rundll32.exe	28
PID 1636 wrote to memory of 2680	1636	rundll32.exe	28
PID 1636 wrote to memory of 2680	1636	rundll32.exe	28
PID 1636 wrote to memory of 2680	1636	rundll32.exe	28
PID 1636 wrote to memory of 2680	1636	rundll32.exe	28
PID 1636 wrote to memory of 2680	1636	rundll32.exe	28
PID 2680 wrote to memory of 2988	2680	rundll32.exe	29
PID 2680 wrote to memory of 2988	2680	rundll32.exe	29
PID 2680 wrote to memory of 2988	2680	rundll32.exe	29
PID 2680 wrote to memory of 2988	2680	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 220
    3⤵
    - Program crash
    PID:2988