c37ac379f7614de0382c60dee8470067c15397a0679cff1f6e4b7f6b40f029b6

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 18:08

Target

$PLUGINSDIR/advsplash.dll
Size

6KB
MD5

505c7c214c17ac801f5930abc57d38c3
SHA1

e9a17ed8182f92bf86babbd7ba8dd8770e8ff47e
SHA256

999ebf5ef6bf51828193deaf7697e6d22419e437c65e603bffa0bb2acc7f40c8
SHA512

30686f361db9d81c95912700af530529d4d89bf6b514a63ab5db6b20efc443b87aef44b598e45d33adee448ec1b6573ca035a1d20e11c78ea8253f1ecf5ebf38
SSDEEP

96:oIUNaXnnXyEIPtXvZhr5RwiULuxDtJy+wolpE:oIx3XyEwXvZh1RwnLUDtU+I

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
320	500	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 500	1312	rundll32.exe	28
PID 1312 wrote to memory of 500	1312	rundll32.exe	28
PID 1312 wrote to memory of 500	1312	rundll32.exe	28
PID 1312 wrote to memory of 500	1312	rundll32.exe	28
PID 1312 wrote to memory of 500	1312	rundll32.exe	28
PID 1312 wrote to memory of 500	1312	rundll32.exe	28
PID 1312 wrote to memory of 500	1312	rundll32.exe	28
PID 500 wrote to memory of 320	500	rundll32.exe	29
PID 500 wrote to memory of 320	500	rundll32.exe	29
PID 500 wrote to memory of 320	500	rundll32.exe	29
PID 500 wrote to memory of 320	500	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\advsplash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\advsplash.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 500 -s 232
    3⤵
    - Program crash
    PID:320