b87cfba8a4f2329b0b372326a7f169f5896459a6bdae0ad8857b576129722204

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 13:49

Target

$TEMP/planula.dll
Size

72KB
MD5

6abeff0d3c52cf017e36e941f035c3e9
SHA1

ba0f193dd98a5502c29c4f5671ed066e2a3ae38c
SHA256

da93766a660b71b43492920bdb0478359fe86a17a3f51a0329cf6ac77e0852b2
SHA512

8b256cc4787c7aee904e36c3772916a5d06c5bde96e9bda3897ca1e7e7e1099d5e46e0d921bed64a1633a91508301ee8568211f02d7dac5dde9f84a57a5ac0a7
SSDEEP

768:RWGCacHgiB4722o+oOc2dIMSWwhC/ox1ozef/coG+izus+9dIt1t7RkUi4e9X:YIVS2o+c2dnSWV/oGe8n329dstlfe

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
28828	2124	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2124	2432	rundll32.exe	28
PID 2432 wrote to memory of 2124	2432	rundll32.exe	28
PID 2432 wrote to memory of 2124	2432	rundll32.exe	28
PID 2432 wrote to memory of 2124	2432	rundll32.exe	28
PID 2432 wrote to memory of 2124	2432	rundll32.exe	28
PID 2432 wrote to memory of 2124	2432	rundll32.exe	28
PID 2432 wrote to memory of 2124	2432	rundll32.exe	28
PID 2124 wrote to memory of 28828	2124	rundll32.exe	29
PID 2124 wrote to memory of 28828	2124	rundll32.exe	29
PID 2124 wrote to memory of 28828	2124	rundll32.exe	29
PID 2124 wrote to memory of 28828	2124	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\planula.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\planula.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 236
    3⤵
    - Program crash
    PID:28828

memory/2124-0-0x0000000000200000-0x0000000000202000-memory.dmp

Filesize
8KB

Download
memory/2124-1-0x0000000000690000-0x00000000006A1000-memory.dmp

Filesize
68KB

Download
memory/2124-959-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download