053d7833c4436e4fa234438f53a2f0db804142a66ba3f23c637f8a827e94d93d

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
18/05/2024, 10:15

Target
$PLUGINSDIR/System.dll
Size 11KB
Sample240518-maabhaef75
SHA256 269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
MD5 34442e1e0c2870341df55e1b7b3cccdc
SHA1 99b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA512 4a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51
SSDEEP 192:jPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4I:u7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1860	1012	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1012	1900	rundll32.exe	28
PID 1900 wrote to memory of 1012	1900	rundll32.exe	28
PID 1900 wrote to memory of 1012	1900	rundll32.exe	28
PID 1900 wrote to memory of 1012	1900	rundll32.exe	28
PID 1900 wrote to memory of 1012	1900	rundll32.exe	28
PID 1900 wrote to memory of 1012	1900	rundll32.exe	28
PID 1900 wrote to memory of 1012	1900	rundll32.exe	28
PID 1012 wrote to memory of 1860	1012	rundll32.exe	29
PID 1012 wrote to memory of 1860	1012	rundll32.exe	29
PID 1012 wrote to memory of 1860	1012	rundll32.exe	29
PID 1012 wrote to memory of 1860	1012	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 220
    3⤵
    - Program crash
    PID:1860