52dc7c72b26bade4bdee1d62188dd34e97358912e109a1ee61868b8b9d134905

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 15:24

Target

$PLUGINSDIR/inetc.dll
Size

20KB
MD5

c498ae64b4971132bba676873978de1e
SHA1

92e4009cd776b6c8616d8bffade7668ef3cb3c27
SHA256

5552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8
SHA512

8e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7
SSDEEP

384:EVJOXQZkjhm+Np3aWgzxljzbbEUhU7ya4LtU0Ac9khYLMkIX0+GBty3S:EeXQcm+NpqWgzxljzfEUhUua4LtG

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2904 2892 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2904	2892	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1708 wrote to memory of 2892	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 2892	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 2892	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 2892	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 2892	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 2892	1708	rundll32.exe	rundll32.exe
PID 1708 wrote to memory of 2892	1708	rundll32.exe	rundll32.exe
PID 2892 wrote to memory of 2904	2892	rundll32.exe	WerFault.exe
PID 2892 wrote to memory of 2904	2892	rundll32.exe	WerFault.exe
PID 2892 wrote to memory of 2904	2892	rundll32.exe	WerFault.exe
PID 2892 wrote to memory of 2904	2892	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 240
3⤵
- Program crash
PID:2904