1121a23abf827d61a30300db64b472a66911726724e260c17679f27e5bd7cbc3

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 17:49

Target

$PLUGINSDIR/tkDecript.dll
Size

222KB
MD5

ea79ad436f5e54ee5dc2aba13fe1b15a
SHA1

66e248962bfb1f370796dac393621367638c21b1
SHA256

0ae09d65f5284409e6d9a2d40d7aaa8cbf1dd1815e67a9c12a9557f5de1f7832
SHA512

dbd40403126c6ef6f5747c900809140c8897376f03696247cd8d10431bec7abb0c7191761e8ea551cfde2234059ec087ffbca54510ddf0dc78b8329f598fab2e
SSDEEP

3072:db0IC6Lh2wWcNA5ZX9VZo6w+ck5yUbTIQ2npANCrYJ5+S+cHOZjvqte36wI1:db0GLhqa8ZorcyQiTrcwZjiu6wi

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1892	1312	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 2240 wrote to memory of 1312	2240	rundll32.exe	28
PID 1312 wrote to memory of 1892	1312	rundll32.exe	29
PID 1312 wrote to memory of 1892	1312	rundll32.exe	29
PID 1312 wrote to memory of 1892	1312	rundll32.exe	29
PID 1312 wrote to memory of 1892	1312	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tkDecript.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tkDecript.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 224
    3⤵
    - Program crash
    PID:1892