258fdbddc8ae716a73b26ec17d3dc8773a427f0b695f2fddfbda0c5c11a7516d

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 02:20

Target
$PLUGINSDIR/System.dll
Size 12KB
Sample240517-csqq4adb83
SHA256 edf12a3040cff0d801a86c02313d6605b41d766807f3dcb261754cf01b4e14b9
MD5 e227391c7ff576135eac4871e78ebe2d
SHA1 85d4bdbb79bdc47095ca35ed2141b2e64d029218
SHA512 06f1b65dd980c6aac17518faf34d200453fedf893efa01bfc71128ccb1a70abcd7165f581c9789caf80776fac313a4e754df7b58f7467930a666de37b55396a6
SSDEEP 192:asA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:hR7SrtTv53tdtTgwF4SQbGPX36wJMw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	2192	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2348 wrote to memory of 2192	2348	rundll32.exe	29
PID 2192 wrote to memory of 2640	2192	rundll32.exe	30
PID 2192 wrote to memory of 2640	2192	rundll32.exe	30
PID 2192 wrote to memory of 2640	2192	rundll32.exe	30
PID 2192 wrote to memory of 2640	2192	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 220
    3⤵
    - Program crash
    PID:2640