91179c199ca069ef07cb1939aa20cc1ee3c91b4528402a6e3df424da2982b5ca

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 08:10

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

9eb662f3b5fbda28bffe020e0ab40519
SHA1

0bd28183a9d8dbb98afbcf100fb1f4f6c5fc6c41
SHA256

9aa388c7de8e96885adcb4325af871b470ac50edb60d4b0d876ad43f5332ffd1
SHA512

6c36f7b45efe792c21d8a87d03e63a4b641169fad6d014db1e7d15badd0e283144d746d888232d6123b551612173b2bb42bf05f16e3129b625f5ddba4134b5b8

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2088 3028 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2088	3028	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 1724 wrote to memory of 3028	1724	rundll32.exe	rundll32.exe
PID 3028 wrote to memory of 2088	3028	rundll32.exe	WerFault.exe
PID 3028 wrote to memory of 2088	3028	rundll32.exe	WerFault.exe
PID 3028 wrote to memory of 2088	3028	rundll32.exe	WerFault.exe
PID 3028 wrote to memory of 2088	3028	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 220
    3⤵
    - Program crash
    PID:2088