8ef8966a875cbad9a45f07de83771c2bdddb8f776241db410240d6c3ca20314d

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 05:26

Target

$PLUGINSDIR/System.dll
Size

16KB
MD5

b229694657d51375d45d2fe5bd2a0616
SHA1

4fd6e5ce354f7d72613213c57c20d362c11d4d2f
SHA256

36eb621d65ed1236d4e1b8cb01dd39cc69ab5052f227fb21694830e60703a739
SHA512

fcf47391964d90ac52ceda9a6cdfddea60ab09c251ebd89f48443a1880817f89b9d0db2d1830b7ad17787e4df9a534aea8e7fd826cef2f677b7c2e693bbdf4da
SSDEEP

384:9CAGCYNs4C/nWxVg8kTM1yTFYgLMCVORJO3eMIAE:9C9CYNnC/P8kg18TgTJOpE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	2748	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2552 wrote to memory of 2748	2552	rundll32.exe	28
PID 2748 wrote to memory of 2100	2748	rundll32.exe	29
PID 2748 wrote to memory of 2100	2748	rundll32.exe	29
PID 2748 wrote to memory of 2100	2748	rundll32.exe	29
PID 2748 wrote to memory of 2100	2748	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 224
    3⤵
    - Program crash
    PID:2100