3c3cf3d710582ccbb7a45139c1acc3a8d6bcfc017b9a4aeae6bf34a292f057cd

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 00:13

Target

$PLUGINSDIR/ElevatePrivileges.dll
Size

81KB
MD5

662f8362261ba53141b2bc88499acbcf
SHA1

e976f6928f12451e5e30d707626cfa5eb8a26afc
SHA256

0d98f84230c3adddf5e5b91cc614071abf84a00b763e6c22117543796ae13e78
SHA512

d1027454efd2b905cb3a8a356c24647d8bace9895cf6968c65e1dbfa7870f34339bddac52d3eab52742a541b3078f2c79ead60e7bf495718167c5c3868abb8b7
SSDEEP

1536:hqpzymwTMsDb3BRhTmry0SkMnKBWCYRb4z+8vI:hq1ym7sDb3SywWCIbAvI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1704 3012 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1704	3012	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2848 wrote to memory of 3012	2848	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 3012	2848	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 3012	2848	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 3012	2848	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 3012	2848	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 3012	2848	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 3012	2848	rundll32.exe	rundll32.exe
PID 3012 wrote to memory of 1704	3012	rundll32.exe	WerFault.exe
PID 3012 wrote to memory of 1704	3012	rundll32.exe	WerFault.exe
PID 3012 wrote to memory of 1704	3012	rundll32.exe	WerFault.exe
PID 3012 wrote to memory of 1704	3012	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ElevatePrivileges.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ElevatePrivileges.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 220
    3⤵
    - Program crash
    PID:1704