5a05f7c50928cffc850b084067bce03ab042038a12fe8e8c4c5b183cef4420de

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 16:38

Target

$PLUGINSDIR/System.dll
Size

12KB
MD5

e227391c7ff576135eac4871e78ebe2d
SHA1

85d4bdbb79bdc47095ca35ed2141b2e64d029218
SHA256

edf12a3040cff0d801a86c02313d6605b41d766807f3dcb261754cf01b4e14b9
SHA512

06f1b65dd980c6aac17518faf34d200453fedf893efa01bfc71128ccb1a70abcd7165f581c9789caf80776fac313a4e754df7b58f7467930a666de37b55396a6
SSDEEP

192:asA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:hR7SrtTv53tdtTgwF4SQbGPX36wJMw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2068	2132	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2132	3016	rundll32.exe	28
PID 3016 wrote to memory of 2132	3016	rundll32.exe	28
PID 3016 wrote to memory of 2132	3016	rundll32.exe	28
PID 3016 wrote to memory of 2132	3016	rundll32.exe	28
PID 3016 wrote to memory of 2132	3016	rundll32.exe	28
PID 3016 wrote to memory of 2132	3016	rundll32.exe	28
PID 3016 wrote to memory of 2132	3016	rundll32.exe	28
PID 2132 wrote to memory of 2068	2132	rundll32.exe	29
PID 2132 wrote to memory of 2068	2132	rundll32.exe	29
PID 2132 wrote to memory of 2068	2132	rundll32.exe	29
PID 2132 wrote to memory of 2068	2132	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 220
    3⤵
    - Program crash
    PID:2068