602baab3e174a495e5606300d166dc2fe54e903d93b382759859d451f9dd1c0e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 08:33

Target
$PLUGINSDIR/System.dll
Size 11KB
Sample240603-kf28csae42
SHA256 93a8e95708882e56250ae55aef93417333b2dbe7ea99590abed34cdca2227e61
MD5 c51fc979c1c3e17bece7bd194aeb6ea2
SHA1 9a5d000d6393f2980062b4cc6e8f543493b1be8f
SHA512 716cdeb890307ff42901464dd24aa94e29415ef20d4e975c2733e34330fdf85edfd4ad9e00878edbe98921deebe44153279cb95acb309c5e1812026716dcdc4e
SSDEEP 192:sfer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4SyYXe:sw7Xws4FVWig86/5eCBqSyYXe
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2872	2224	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2224	2856	rundll32.exe	28
PID 2856 wrote to memory of 2224	2856	rundll32.exe	28
PID 2856 wrote to memory of 2224	2856	rundll32.exe	28
PID 2856 wrote to memory of 2224	2856	rundll32.exe	28
PID 2856 wrote to memory of 2224	2856	rundll32.exe	28
PID 2856 wrote to memory of 2224	2856	rundll32.exe	28
PID 2856 wrote to memory of 2224	2856	rundll32.exe	28
PID 2224 wrote to memory of 2872	2224	rundll32.exe	29
PID 2224 wrote to memory of 2872	2224	rundll32.exe	29
PID 2224 wrote to memory of 2872	2224	rundll32.exe	29
PID 2224 wrote to memory of 2872	2224	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 224
    3⤵
    - Program crash
    PID:2872