91179c199ca069ef07cb1939aa20cc1ee3c91b4528402a6e3df424da2982b5ca

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 08:10

Target
$PLUGINSDIR/UserInfo.dll
Size 4KB
Sample240603-j2tyfagg6w
SHA256 9aa388c7de8e96885adcb4325af871b470ac50edb60d4b0d876ad43f5332ffd1
MD5 9eb662f3b5fbda28bffe020e0ab40519
SHA1 0bd28183a9d8dbb98afbcf100fb1f4f6c5fc6c41
SHA512 6c36f7b45efe792c21d8a87d03e63a4b641169fad6d014db1e7d15badd0e283144d746d888232d6123b551612173b2bb42bf05f16e3129b625f5ddba4134b5b8
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	3028	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 1724 wrote to memory of 3028	1724	rundll32.exe	28
PID 3028 wrote to memory of 2088	3028	rundll32.exe	29
PID 3028 wrote to memory of 2088	3028	rundll32.exe	29
PID 3028 wrote to memory of 2088	3028	rundll32.exe	29
PID 3028 wrote to memory of 2088	3028	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 220
    3⤵
    - Program crash
    PID:2088