48448e88e40d765e8b60252c6b8eb40785f57cfad025fe173318e9e78c8cb612

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 21:15

Target

$PLUGINSDIR/inetc.dll
Size

20KB
MD5

4c01fdfd2b57b32046b3b3635a4f4df8
SHA1

e0af8e418cbe2b2783b5de93279a3b5dcb73490e
SHA256

b98e21645910f82b328f30c644b86c112969b42697e797671647b09eb40ad014
SHA512

cbd354536e2a970d31ba69024208673b1dc56603ad604ff17c5840b4371958fc22bafd90040ae3fb19ae9c248b2cfce08d0bc73cc93481f02c73b86dbc0697b2
SSDEEP

384:rJBJ8VnX8K+uKn2WQJdxbs3aEUhU7ya4L60Ac9khYLMkIX0+GwNyEAG:3J8+K+uK2WQJdxbsqEUhUua4L6AG

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1548	3024	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3024	2936	rundll32.exe	28
PID 2936 wrote to memory of 3024	2936	rundll32.exe	28
PID 2936 wrote to memory of 3024	2936	rundll32.exe	28
PID 2936 wrote to memory of 3024	2936	rundll32.exe	28
PID 2936 wrote to memory of 3024	2936	rundll32.exe	28
PID 2936 wrote to memory of 3024	2936	rundll32.exe	28
PID 2936 wrote to memory of 3024	2936	rundll32.exe	28
PID 3024 wrote to memory of 1548	3024	rundll32.exe	29
PID 3024 wrote to memory of 1548	3024	rundll32.exe	29
PID 3024 wrote to memory of 1548	3024	rundll32.exe	29
PID 3024 wrote to memory of 1548	3024	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 236
    3⤵
    - Program crash
    PID:1548