94fef3ee9512941ff1aa4c8a951598ae67c42b71fbc047d28f3164570497d0b0

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 03:43

Target

$PLUGINSDIR/System.dll
Size

11KB
MD5

f55b41485cbaf292389a52f8e4f0594b
SHA1

89e9b0d1291fa78a40cab358553c447cbbeaa130
SHA256

f16bc2ceb7a6bc7df0955530e72b0aa072ce27650c5cf7b33fd4ea82dea196fc
SHA512

938e8661b8cf418608156dc813c1eb0cc3fa5efa9483061a152bb103c4d821d5c6a82d4c110729e9686f99ccd4da188aebb38a85a01d8ecadb34bb9f6ba60d09
SSDEEP

192:uDKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQbfSF:uViJrtFRdbmXK8+Wfw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2952	2784	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2916 wrote to memory of 2784	2916	rundll32.exe	28
PID 2784 wrote to memory of 2952	2784	rundll32.exe	29
PID 2784 wrote to memory of 2952	2784	rundll32.exe	29
PID 2784 wrote to memory of 2952	2784	rundll32.exe	29
PID 2784 wrote to memory of 2952	2784	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2784 -s 224
    3⤵
    - Program crash
    PID:2952