0a6180189e4f5911e0bdf60d52fa85a31cf1f6a55625b3bb17d066e07a1a4705

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:20

Target

$PLUGINSDIR/Registry.dll
Size

93KB
MD5

33ca3018c1ba8cab6b1acf0e79103618
SHA1

e31f4c54bd9d76eb68f5e0ef08a99f241e981947
SHA256

8078be74f4cd4b6aeb4fb3d5d0d467d4ca32bdb18ea48ce2ab07dc61ab7484c7
SHA512

f0fd4fce7dc9d77ccfd8c692db59e5e3e90f54887947ffba8dee4452403746ecfa2281b44380c4b3f00c6c78cd6babc12c43805e55064d502e012f3f33c3579f
SSDEEP

1536:UdxbSzGuoHghElK3/O2yLvPmWwUgSc/Ze+tGYNJk1teOtAbltg:UdxbSzGuR53/bKeFUOltGYNJ0teOtAbI

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	2928	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2908 wrote to memory of 2928	2908	rundll32.exe	28
PID 2928 wrote to memory of 2252	2928	rundll32.exe	29
PID 2928 wrote to memory of 2252	2928	rundll32.exe	29
PID 2928 wrote to memory of 2252	2928	rundll32.exe	29
PID 2928 wrote to memory of 2252	2928	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Registry.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Registry.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 220
    3⤵
    - Program crash
    PID:2252