a469d8ec35c86e1e94f31c37c3008a3e445fee8c62a0f855716e2fe6bd906e19

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 09:41

Target

$PLUGINSDIR/System.dll
Size

11KB
MD5

55a26d7800446f1373056064c64c3ce8
SHA1

80256857e9a0a9c8897923b717f3435295a76002
SHA256

904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
SHA512

04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b
SSDEEP

192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2360	1628	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1628	2756	rundll32.exe	28
PID 2756 wrote to memory of 1628	2756	rundll32.exe	28
PID 2756 wrote to memory of 1628	2756	rundll32.exe	28
PID 2756 wrote to memory of 1628	2756	rundll32.exe	28
PID 2756 wrote to memory of 1628	2756	rundll32.exe	28
PID 2756 wrote to memory of 1628	2756	rundll32.exe	28
PID 2756 wrote to memory of 1628	2756	rundll32.exe	28
PID 1628 wrote to memory of 2360	1628	rundll32.exe	29
PID 1628 wrote to memory of 2360	1628	rundll32.exe	29
PID 1628 wrote to memory of 2360	1628	rundll32.exe	29
PID 1628 wrote to memory of 2360	1628	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 224
    3⤵
    - Program crash
    PID:2360