24c71c882f17b7f8564f248187dfa21aba0d216ec8202107bf68ed42b68d3217

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 13:56

Target

$PLUGINSDIR/pndoaei.dll
Size

169KB
MD5

0cfdfa96c59f3b1fd57b330b3fca90f1
SHA1

a611a4e7a61512a3154a3b7e2710261d50c5d59c
SHA256

5a790862db0fd7430c18866ddc6c7e2eb9531579e3bf59d85acde167ed6af95f
SHA512

88de60b5e25fe6403ed39e16df166b15b4058752f5a4cd6fb51cae648f402bbe89367018fd8f96e31f66a54a2abbd27ce5f0700fce33404f4b6b4cc1f9b9db82
SSDEEP

3072:G9rwNy3wymgKNVcSmYZP3C+CwUz2mCKj:KrwggKSmYZa0kt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2904	2892	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2892	2684	rundll32.exe	28
PID 2684 wrote to memory of 2892	2684	rundll32.exe	28
PID 2684 wrote to memory of 2892	2684	rundll32.exe	28
PID 2684 wrote to memory of 2892	2684	rundll32.exe	28
PID 2684 wrote to memory of 2892	2684	rundll32.exe	28
PID 2684 wrote to memory of 2892	2684	rundll32.exe	28
PID 2684 wrote to memory of 2892	2684	rundll32.exe	28
PID 2892 wrote to memory of 2904	2892	rundll32.exe	29
PID 2892 wrote to memory of 2904	2892	rundll32.exe	29
PID 2892 wrote to memory of 2904	2892	rundll32.exe	29
PID 2892 wrote to memory of 2904	2892	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\pndoaei.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\pndoaei.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 224
    3⤵
    - Program crash
    PID:2904