05abcaacc5ee162814748435645b745b6f3467f38f753fe51668167a215125ef

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 21:06

Target

$PLUGINSDIR/CABSetup.dll
Size

30KB
MD5

0645c3c0a775041eb51277c4e93121ef
SHA1

3963d0016da8c2ec51777357fe5e615a1308c3b5
SHA256

91687b6cd88653f0be20b129c16dd14dd5f909a4d096218d3306ec62d3c260a2
SHA512

5a192ce1eaad049027c362e7a0c85a705ef8045c268e7fb09eab364c6da27929ab78fccf755145ea620deeb32a0954c62aa7d699249057fcd5522d45c0937a47
SSDEEP

768:BEjXk0000E0ZKz8BKvr/TTR+Hwh87O2bTGgbpffoHha:BKyuvrrdwwy7O2bTGwfoB

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2112	3024	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 1280 wrote to memory of 3024	1280	rundll32.exe	28
PID 3024 wrote to memory of 2112	3024	rundll32.exe	29
PID 3024 wrote to memory of 2112	3024	rundll32.exe	29
PID 3024 wrote to memory of 2112	3024	rundll32.exe	29
PID 3024 wrote to memory of 2112	3024	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CABSetup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\CABSetup.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 220
    3⤵
    - Program crash
    PID:2112