fa299a5245c5720465dcf5cd5e88c18700c14d19b7a247f965edf5f22370433b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-es
resource tags

arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
submitted
20-05-2024 19:34

Target

$PLUGINSDIR/ThreadTimer.dll
Size

3KB
MD5

1ef958d9667a3e548eabb533ebf18175
SHA1

79f9be24ce78a11944dec5bddd99c3d52a389ffc
SHA256

8b3b4ac7e82ad70222016975d51347abc0e2f8ace27d7a9aae940e3d2140c08f
SHA512

2a060b23e057a40b21f922368d591ca84117d024c033526ceba26847436f20f230472e23b212bf99dd8746b3e39b7844f502236a912401ea07dd03cba75b5921

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2400	2192	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2192	2340	rundll32.exe	28
PID 2340 wrote to memory of 2192	2340	rundll32.exe	28
PID 2340 wrote to memory of 2192	2340	rundll32.exe	28
PID 2340 wrote to memory of 2192	2340	rundll32.exe	28
PID 2340 wrote to memory of 2192	2340	rundll32.exe	28
PID 2340 wrote to memory of 2192	2340	rundll32.exe	28
PID 2340 wrote to memory of 2192	2340	rundll32.exe	28
PID 2192 wrote to memory of 2400	2192	rundll32.exe	29
PID 2192 wrote to memory of 2400	2192	rundll32.exe	29
PID 2192 wrote to memory of 2400	2192	rundll32.exe	29
PID 2192 wrote to memory of 2400	2192	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ThreadTimer.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ThreadTimer.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 224
    3⤵
    - Program crash
    PID:2400