c962e389ee68c863b2aa54f7d1147ef2e13eef43a4f7a3033ab291eb422db628

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 00:50

Target

$PLUGINSDIR/RealSpeedup.dll
Size

32.5MB
MD5

588ec0b41aec420aa6b898c86b571d2e
SHA1

d92e663e2a197d436dd112951814c212e41be9a3
SHA256

890109c062672432707f1a6b44c90e57e0e131aec4e8c1f7ef24b0058e0da784
SHA512

fed27edee1287dfd201c45918bcea1e6edcd6f7ff48180d9047a6449a1bf45bd69facf57edb65333bd8b34bbdd89958630181bf943b8f0baba98198b144951c9
SSDEEP

49152:i1E20H2KcwXVlPGYRJJbSGnwnQKefUQ0:+E2kdXVl+YRJZJXH

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1596	1536	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1536	3056	rundll32.exe	28
PID 3056 wrote to memory of 1536	3056	rundll32.exe	28
PID 3056 wrote to memory of 1536	3056	rundll32.exe	28
PID 3056 wrote to memory of 1536	3056	rundll32.exe	28
PID 3056 wrote to memory of 1536	3056	rundll32.exe	28
PID 3056 wrote to memory of 1536	3056	rundll32.exe	28
PID 3056 wrote to memory of 1536	3056	rundll32.exe	28
PID 1536 wrote to memory of 1596	1536	rundll32.exe	29
PID 1536 wrote to memory of 1596	1536	rundll32.exe	29
PID 1536 wrote to memory of 1596	1536	rundll32.exe	29
PID 1536 wrote to memory of 1596	1536	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RealSpeedup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\RealSpeedup.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 232
    3⤵
    - Program crash
    PID:1596