9d6ed95597857927f0e7e6eb1495c4ec10fa74aced7efbc9199c4392be7585a6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:57

Target

$PLUGINSDIR/inetc.dll
Size

152KB
MD5

f33493944b33bc82194d64fe4ed4057c
SHA1

ee1905acdacb31398c5bddb80562e4850b2665a7
SHA256

09790036c31481a93d0ec9601fbd7a0c70ce70aa020dbeaf4e10e4b12042679d
SHA512

9e12febf0e66a0a269135fea061386180f251bb767943f8aa3fba8398fd54b3b4de28a1a781daafb2300b61216e2d597756bf403a608f0a37bfd8749a288fad4
SSDEEP

1536:1Dc5IbWa6UzkT64jD9/Z2gi58LiKJoXdN7EC3/dL7HvteEhxsp+BhQzxcVaevh:hOIiT3j5PLilAq36+BhQzxcoeJ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1812 2044 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1812	2044	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2180 wrote to memory of 2044	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2044	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2044	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2044	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2044	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2044	2180	rundll32.exe	rundll32.exe
PID 2180 wrote to memory of 2044	2180	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1812	2044	rundll32.exe	WerFault.exe
PID 2044 wrote to memory of 1812	2044	rundll32.exe	WerFault.exe
PID 2044 wrote to memory of 1812	2044	rundll32.exe	WerFault.exe
PID 2044 wrote to memory of 1812	2044	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 236
3⤵
- Program crash
PID:1812