f506ec5cb0402dd85556c5cfd38d6b5de72e8bd242aa7a2143ab1063c19f0bc2

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 14:34

Target

$PLUGINSDIR/KillProcDLL.dll
Size

44KB
MD5

fde8e3023321c239559dd1892055a124
SHA1

e74ea4b05417e429429936ff72334723ccf8b5ff
SHA256

f167fd1301d0320d6e3ce562bea5c59f4d7dd39e1d4365e3a7bc76fb617bf49b
SHA512

123c61e4ef681fc20504e4857f35594a62d7ca6bb2008667e8d3540c3290ac7a923690c25a98420c839c0dd68a4a8a76fc126d38091ec7e9de11d0a7d093f9fb
SSDEEP

768:NHosAFTn8biOhR8XdTGPAkgoF6ldVHjBA81pca5qNZW:NHpAN8J8yAHoF6XVrf5j

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2156	2136	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2136	1872	rundll32.exe	29
PID 1872 wrote to memory of 2136	1872	rundll32.exe	29
PID 1872 wrote to memory of 2136	1872	rundll32.exe	29
PID 1872 wrote to memory of 2136	1872	rundll32.exe	29
PID 1872 wrote to memory of 2136	1872	rundll32.exe	29
PID 1872 wrote to memory of 2136	1872	rundll32.exe	29
PID 1872 wrote to memory of 2136	1872	rundll32.exe	29
PID 2136 wrote to memory of 2156	2136	rundll32.exe	30
PID 2136 wrote to memory of 2156	2136	rundll32.exe	30
PID 2136 wrote to memory of 2156	2136	rundll32.exe	30
PID 2136 wrote to memory of 2156	2136	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProcDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\KillProcDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 224
    3⤵
    - Program crash
    PID:2156