8f3cfcedaf845387e4f7d07c77db62ad6f3c6856995ed8e0d1cdcecef17e0bbc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 09:04

Target

$PLUGINSDIR/DotNetChecker.dll
Size

83KB
MD5

e02ed575cffbc793af912c5541c7ffb3
SHA1

1fd8f5ed9417b3804c1fbd18340eba4d09326f60
SHA256

45e15d319084e019d4db5a3081533ba8c032308cf35384abf8b65ddbac6c5f9d
SHA512

76804c9df7f97dc50ff375d1f1d972f2d20b57e2c543986a47de61fc2a0ec87225bc22d69ef31a37a12ecec46e477595184a964587ef469d6b0698cd71ebb5f8
SSDEEP

1536:bg5jFZGXKkwO1V2+XDlM7IVNBNN4GS0CPrAm0dgKQUDs0OsWPIcdngsi9eJ:byCC7iN4rrPhKQngsi9eJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2056	2192	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2192	2140	rundll32.exe	28
PID 2140 wrote to memory of 2192	2140	rundll32.exe	28
PID 2140 wrote to memory of 2192	2140	rundll32.exe	28
PID 2140 wrote to memory of 2192	2140	rundll32.exe	28
PID 2140 wrote to memory of 2192	2140	rundll32.exe	28
PID 2140 wrote to memory of 2192	2140	rundll32.exe	28
PID 2140 wrote to memory of 2192	2140	rundll32.exe	28
PID 2192 wrote to memory of 2056	2192	rundll32.exe	29
PID 2192 wrote to memory of 2056	2192	rundll32.exe	29
PID 2192 wrote to memory of 2056	2192	rundll32.exe	29
PID 2192 wrote to memory of 2056	2192	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DotNetChecker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DotNetChecker.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 220
    3⤵
    - Program crash
    PID:2056