23a66b32dfa75a94036870a1dce0bfabe6b52331eb2bed02e6953b9fead97298

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 12:12

Target

$PLUGINSDIR/SysRestore.dll
Size

5KB
MD5

da046184a8d7269a0e138b0b0b9b2eb5
SHA1

d9bc5ea397857e17a86f80df1e50615eb6859044
SHA256

c5e335bd19fa798f120287fe3ed920296f899223942fd6b987585a765f0adec2
SHA512

9ee6965ac931839a5d61b4ed64bb3bbf434dfd10ff086c38a998ec6714018b5491da7e5c29e4f7dd7fd4a93b2f285869b20f88b4b0194c9ba7824ff7c9f03c80
SSDEEP

48:S5SjUZmikqTB1By5B6UBQzcszn3x3YlE41tq9/Iye:ASOz5ns4UeI2B3Z41tqlc

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2088 1508 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2088	1508	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2024 wrote to memory of 1508	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1508	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1508	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1508	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1508	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1508	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 1508	2024	rundll32.exe	rundll32.exe
PID 1508 wrote to memory of 2088	1508	rundll32.exe	WerFault.exe
PID 1508 wrote to memory of 2088	1508	rundll32.exe	WerFault.exe
PID 1508 wrote to memory of 2088	1508	rundll32.exe	WerFault.exe
PID 1508 wrote to memory of 2088	1508	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SysRestore.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\SysRestore.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 220
    3⤵
    - Program crash
    PID:2088