0a6180189e4f5911e0bdf60d52fa85a31cf1f6a55625b3bb17d066e07a1a4705

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:20

Target

$PLUGINSDIR/SaveInExe.dll
Size

112KB
MD5

19fa9ebf6249ad9859e3e8e8801a8bdd
SHA1

68961532b00b21140d86686d2f3236d68bb397c6
SHA256

c65fee48577525063f7acd960cd0869bb5e425968b2a8a94d130a9d7fb5a3ba2
SHA512

1d9d9d7f247cb94e238c2accfa34e317a72a9456c840fb972c638200f038629cb937e7fcb162bf39dbe9b47b28c19440b4772aebd18938e487eeec9b41420af5
SSDEEP

1536:CGM6oK9K7ELycM1/40zv4ThZkKiom9EnwGVGi2ICrFodRUax/tj9XSz0qFJSJ:9M61vycOzzKjmVB9redRUwV07nS

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2220 2616 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2220	2616	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2108 wrote to memory of 2616	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 2616	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 2616	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 2616	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 2616	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 2616	2108	rundll32.exe	rundll32.exe
PID 2108 wrote to memory of 2616	2108	rundll32.exe	rundll32.exe
PID 2616 wrote to memory of 2220	2616	rundll32.exe	WerFault.exe
PID 2616 wrote to memory of 2220	2616	rundll32.exe	WerFault.exe
PID 2616 wrote to memory of 2220	2616	rundll32.exe	WerFault.exe
PID 2616 wrote to memory of 2220	2616	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SaveInExe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SaveInExe.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 220
3⤵
- Program crash
PID:2220