0a6180189e4f5911e0bdf60d52fa85a31cf1f6a55625b3bb17d066e07a1a4705

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:20

Target

$PLUGINSDIR/Registry.dll
Size

93KB
MD5

33ca3018c1ba8cab6b1acf0e79103618
SHA1

e31f4c54bd9d76eb68f5e0ef08a99f241e981947
SHA256

8078be74f4cd4b6aeb4fb3d5d0d467d4ca32bdb18ea48ce2ab07dc61ab7484c7
SHA512

f0fd4fce7dc9d77ccfd8c692db59e5e3e90f54887947ffba8dee4452403746ecfa2281b44380c4b3f00c6c78cd6babc12c43805e55064d502e012f3f33c3579f
SSDEEP

1536:UdxbSzGuoHghElK3/O2yLvPmWwUgSc/Ze+tGYNJk1teOtAbltg:UdxbSzGuR53/bKeFUOltGYNJ0teOtAbI

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2252 2928 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2252	2928	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2908 wrote to memory of 2928	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2928	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2928	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2928	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2928	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2928	2908	rundll32.exe	rundll32.exe
PID 2908 wrote to memory of 2928	2908	rundll32.exe	rundll32.exe
PID 2928 wrote to memory of 2252	2928	rundll32.exe	WerFault.exe
PID 2928 wrote to memory of 2252	2928	rundll32.exe	WerFault.exe
PID 2928 wrote to memory of 2252	2928	rundll32.exe	WerFault.exe
PID 2928 wrote to memory of 2252	2928	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Registry.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Registry.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 220
3⤵
- Program crash
PID:2252