5ea92cd1af34a0faf1293afa648e3e1e610d89deaf663b4a75a38fbf03ba99dc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:19

Target

$PLUGINSDIR/FileInfo.dll
Size

720KB
MD5

a3226dd87d13bb425e1a9d180eed3018
SHA1

6b247e0ed12ef17eff962aaeeb8547c5288e0904
SHA256

83c0b802b0c1f5fb2eefb428296b8424f7cd724f9b51384220d20f9ca34d842f
SHA512

d6d90d9ea051eef9a3d41e24929a0ebd577562fabd5ad82bef3107348022fec05921de7c76c0961ab0a6ef7609f9c6c5c6b3372cf23b52dbe90c1b666223a73e
SSDEEP

12288:KyverRy6NIkxFMu+4dC61me3qwwvXHJv1+w/ECsFvScB0MG8R5Tfb+2mPousVQO:Kyve9ywx3V739wBv1+wudS+0M7rTfS2n

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2464 1028 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2464	1028	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2488 wrote to memory of 1028	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 1028	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 1028	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 1028	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 1028	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 1028	2488	rundll32.exe	rundll32.exe
PID 2488 wrote to memory of 1028	2488	rundll32.exe	rundll32.exe
PID 1028 wrote to memory of 2464	1028	rundll32.exe	WerFault.exe
PID 1028 wrote to memory of 2464	1028	rundll32.exe	WerFault.exe
PID 1028 wrote to memory of 2464	1028	rundll32.exe	WerFault.exe
PID 1028 wrote to memory of 2464	1028	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 228
3⤵
- Program crash
PID:2464