0d5def3720993c7ff853209226c0becaee1a367ee2d69dae8cf9cb951602b4e6

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 00:37

Target

$PLUGINSDIR/reportsetup.dll
Size

309KB
MD5

52c3b9ac0484ece3b524a9526272f88e
SHA1

c07268de6a13290acbf58ec5ef75e2468533d791
SHA256

210876c0ff70ffaa88a05f9ef794a96136549f4168e940e256fb4ac85b0fff71
SHA512

da7710404e5630509eeaf9e318e2a4a2d9c4f269aee6cdce5d2a8f128094e7c92940312fda9913f5c44dce5159b59159f40137ddb2e7975e450f30c6a7b24f47
SSDEEP

6144:9TTPaNT41SBzliGz6WXKzoOCEIMzjKTBR2Z4kgg6D/Uuc:NrmT4uxiGz6WazojEfnKT/2Z4nD/Uuc

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1448 2852 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1448	2852	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2040 wrote to memory of 2852	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2852	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2852	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2852	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2852	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2852	2040	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2852	2040	rundll32.exe	rundll32.exe
PID 2852 wrote to memory of 1448	2852	rundll32.exe	WerFault.exe
PID 2852 wrote to memory of 1448	2852	rundll32.exe	WerFault.exe
PID 2852 wrote to memory of 1448	2852	rundll32.exe	WerFault.exe
PID 2852 wrote to memory of 1448	2852	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\reportsetup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\reportsetup.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 224
3⤵
- Program crash
PID:1448