fa299a5245c5720465dcf5cd5e88c18700c14d19b7a247f965edf5f22370433b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-es
resource tags

arch:x64arch:x86image:win7-20240220-eslocale:es-esos:windows7-x64systemwindows
submitted
20-05-2024 19:34

Target

$PLUGINSDIR/Crypto.dll
Size

3KB
MD5

59b7a89dbff790d69e01409dbc2a2788
SHA1

4ebbee3ebb35add8c1a0e436a4e4c9c5ba47c02a
SHA256

17b9038e66f3f45c4e775b32ad1bf076812d1ca4149198b47f4e0eda416859b1
SHA512

c202034bfbb7aca777326e7fb336e977e79cd9ba3bc7c17e5b6ec9c0222f6df2e1675b7d6bcb3de04a84e6226b193a5e0b81af950bc659fab83d12cd2fb84c04

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	2684	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2684	2688	rundll32.exe	28
PID 2688 wrote to memory of 2684	2688	rundll32.exe	28
PID 2688 wrote to memory of 2684	2688	rundll32.exe	28
PID 2688 wrote to memory of 2684	2688	rundll32.exe	28
PID 2688 wrote to memory of 2684	2688	rundll32.exe	28
PID 2688 wrote to memory of 2684	2688	rundll32.exe	28
PID 2688 wrote to memory of 2684	2688	rundll32.exe	28
PID 2684 wrote to memory of 2500	2684	rundll32.exe	29
PID 2684 wrote to memory of 2500	2684	rundll32.exe	29
PID 2684 wrote to memory of 2500	2684	rundll32.exe	29
PID 2684 wrote to memory of 2500	2684	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Crypto.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Crypto.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 220
    3⤵
    - Program crash
    PID:2500