492df6f4fc4b890b577cce8dc7b96746f5b78d556946343ab85faca9174a6761

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 13:59

Target

$PLUGINSDIR/UAC.dll
Size

16KB
MD5

0d422e0c03a7d9428c6c02175d7dc9f8
SHA1

5e13d49521cfbbe52cd74de8e1682789f0268969
SHA256

9f47ec720d74e538bbc8d0c1118efcbc52e52050dbe98c27029fc35329996f7c
SHA512

2edf47b24c4201e082841824d6ad9047a06e9a877d799e87befaf5d54179c924849d2e608cf9f60a1480828edcd98e19f3d139d19bdb4b96ee4939fe58bf0887
SSDEEP

192:GqzPEcSUa9KbONtrHf9IyMx7A+iCooYJlgNkGcioGZ5vQhjN9ZmyCaMAWkah+2oD:5rEcSUuv4xkOooPXci/ShZKaMAWk5ys

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2440	2080	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2176 wrote to memory of 2080	2176	rundll32.exe	28
PID 2080 wrote to memory of 2440	2080	rundll32.exe	29
PID 2080 wrote to memory of 2440	2080	rundll32.exe	29
PID 2080 wrote to memory of 2440	2080	rundll32.exe	29
PID 2080 wrote to memory of 2440	2080	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 224
    3⤵
    - Program crash
    PID:2440