051d97d1f5d840b7c942ea453c5210571b2c27303a00ea1fa5f89f9eeb162e31

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 12:53

Target

$PLUGINSDIR/hetpbrh.dll
Size

153KB
MD5

680d69caddb35d39626cda7f06ed8de3
SHA1

85b7a9af7658ae4adb4bacf4e087c4f53b0f32e6
SHA256

c6d54c99dff947e74d01be46905cd4ea5171f0e01300caea23fc08d41e52d54a
SHA512

09ce2e5d0e7794aba376493e005c0d7fe75b37ca5366cf52c235cf986161859e867124cf64f8867d27919d5e5277fdc8c365595e75a36aef7ad4026070c0a3bf
SSDEEP

1536:Gja9ei7ByFv4gXykW/E0Zsu0IX/K0hiOzZ1DPvcm/jIXg8Xmna/YxUosCpg+X+bF:G9suHJArZ/kXg8KagjH+eG/nsxf6EL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	2596	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 2596	1500	rundll32.exe	28
PID 1500 wrote to memory of 2596	1500	rundll32.exe	28
PID 1500 wrote to memory of 2596	1500	rundll32.exe	28
PID 1500 wrote to memory of 2596	1500	rundll32.exe	28
PID 1500 wrote to memory of 2596	1500	rundll32.exe	28
PID 1500 wrote to memory of 2596	1500	rundll32.exe	28
PID 1500 wrote to memory of 2596	1500	rundll32.exe	28
PID 2596 wrote to memory of 2792	2596	rundll32.exe	29
PID 2596 wrote to memory of 2792	2596	rundll32.exe	29
PID 2596 wrote to memory of 2792	2596	rundll32.exe	29
PID 2596 wrote to memory of 2792	2596	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hetpbrh.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\hetpbrh.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 220
    3⤵
    - Program crash
    PID:2792