1088c38976f5a7f857f502deb9e0bba7faeb962df17555a212abb4341774d4a7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 03:24

Target

$PLUGINSDIR/tmp5iwdhe.dll
Size

2.3MB
MD5

64506fff60af135a6c7ac270ee576683
SHA1

5f6173fa4731333913c9e3a356c2ac3e7a7a9201
SHA256

47b57964ebce3279e2c9f7491c00194a3c114a5cb4130bda0fd557e6c128b21c
SHA512

1f4f1e91a39810c293a929dcaaaf4aca9575f4bcf7055511f58e328e789aad5b4aef2a4fd8cb2addd59b83252c6b71fd2a52eb61b22590ee7218a548a70ea5d6
SSDEEP

49152:3LvJvQvSvUvDvMv2vXvXv0vXvIvbv6vRv5v4WjOxu7:7vJvQvSvUvDvMv2vXvXv0vXvIvbv6vRT

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3064 1804 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3064	1804	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2596 wrote to memory of 1804	2596	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 1804	2596	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 1804	2596	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 1804	2596	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 1804	2596	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 1804	2596	rundll32.exe	rundll32.exe
PID 2596 wrote to memory of 1804	2596	rundll32.exe	rundll32.exe
PID 1804 wrote to memory of 3064	1804	rundll32.exe	WerFault.exe
PID 1804 wrote to memory of 3064	1804	rundll32.exe	WerFault.exe
PID 1804 wrote to memory of 3064	1804	rundll32.exe	WerFault.exe
PID 1804 wrote to memory of 3064	1804	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tmp5iwdhe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tmp5iwdhe.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 268
3⤵
- Program crash
PID:3064

memory/1804-0-0x0000000000B30000-0x0000000000C87000-memory.dmp

Filesize
1.3MB

Download