8c7cfdd7fcb3c9ab2daf33bde7235cfb866a2fdbc0367db7969f0b685ddaa272

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 08:28

Target
$PLUGINSDIR/FindProcDLL.dll
Size 32KB
Sample240530-kc94ssch33
SHA256 0ac175b28d2a156e71bda214d4a35321c85d434e325624564f0a5eee23c718be
MD5 849abe37c3b8a6dd48089b769ee789c5
SHA1 81d5d6c4d6328059a07ae59878c717211a726512
SHA512 fa1f60aa1e26dffe6a0b2ee8cba6490cc2d1f94613777466ce434a71431bd88f8c3964718f3ea1dd2c8ca41847cc259999bb293ea2591f4f0a0add286229f76f
SSDEEP 384:kZgOCgkqzx8Cu8d1VKZA9dHC8rotc8dfa3FvCyj72y4hUqAbso4AH:kZhCgkqzCsd1AoaWUgSJORbsopH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	2584	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2252 wrote to memory of 2584	2252	rundll32.exe	28
PID 2584 wrote to memory of 3012	2584	rundll32.exe	29
PID 2584 wrote to memory of 3012	2584	rundll32.exe	29
PID 2584 wrote to memory of 3012	2584	rundll32.exe	29
PID 2584 wrote to memory of 3012	2584	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FindProcDLL.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FindProcDLL.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 224
    3⤵
    - Program crash
    PID:3012