165f409d83fa740b9aee823cba0d5842e1362e256bd8d046fba139f0b4dc7290

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 08:59

Target

$PLUGINSDIR/System.dll
Size

23KB
MD5

a64b9c1f10a5434738f6efec8a1399c9
SHA1

a66e15e4125cb358c1e1998ce393f9660e4f65bb
SHA256

2d863a8cebd864ce51052984bd2031d37c9b022bb80c80ec0b1ca382160ae57b
SHA512

53510079aff46a1b98ff7e0055288af2dce8ec3224fa5869fca4c29b33b26bad7bddecde0ded08a07e162d1bfbcca1120c0717a6156967f944567eeb99f942ee
SSDEEP

384:AAQ5GjarYFU76ffyEIPb9p206QrHwIl8ToknCLJy4k9KyFkKCKOin/aY+:A2XixPbPD6gQikUywWkK9/aY+

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	2088	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 1860 wrote to memory of 2088	1860	rundll32.exe	28
PID 2088 wrote to memory of 2864	2088	rundll32.exe	29
PID 2088 wrote to memory of 2864	2088	rundll32.exe	29
PID 2088 wrote to memory of 2864	2088	rundll32.exe	29
PID 2088 wrote to memory of 2864	2088	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 224
    3⤵
    - Program crash
    PID:2864

memory/2088-0-0x000000006E3C0000-0x000000006E3CD000-memory.dmp

Filesize
52KB

Download