4824b32e77aaa215c6497d16df9c022feddd5162fc8a3aa67a609150d91b8e92

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 00:15

Target
$PLUGINSDIR/FileInfo.dll
Size 121KB
Sample240604-ajw6eaed2w
SHA256 8f7d75e4ea90962c8438785b8f32b0069d0402f8befed741a3a98391e478b090
MD5 80fe0f9702d94bb88515f42bf8a4ed34
SHA1 7af08fa14927a2f5ec7121c5adb7bf98514696d9
SHA512 387123c2577e44db41d297c5dc30848d6a733fd233798de642f831b81aada5bb2bd0fa334b3a599468330eeb66efa9655a4fb5c8797b1cfc13a87d9b5d29a696
SSDEEP 1536:UPbjnSKdEa7gtJzYAvqIe6zq204iuX+RJmrcpOzsWjcdGf+mdJuMczQ//5h:UP9pMvRvnRq2NzqO86+mdJuMczQv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2272	2348	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2348	1612	rundll32.exe	28
PID 1612 wrote to memory of 2348	1612	rundll32.exe	28
PID 1612 wrote to memory of 2348	1612	rundll32.exe	28
PID 1612 wrote to memory of 2348	1612	rundll32.exe	28
PID 1612 wrote to memory of 2348	1612	rundll32.exe	28
PID 1612 wrote to memory of 2348	1612	rundll32.exe	28
PID 1612 wrote to memory of 2348	1612	rundll32.exe	28
PID 2348 wrote to memory of 2272	2348	rundll32.exe	29
PID 2348 wrote to memory of 2272	2348	rundll32.exe	29
PID 2348 wrote to memory of 2272	2348	rundll32.exe	29
PID 2348 wrote to memory of 2272	2348	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\FileInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 224
    3⤵
    - Program crash
    PID:2272