ca9fa20f5cecf6a9988527835dc9cae2f03efa22b0e3a19f844161d709acfc63

Analysis

max time kernel
117s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 13:14

Target

$PLUGINSDIR/advsplash.dll
Size

5KB
MD5

74fcb6435b746349a712dd9213975ffd
SHA1

0cd54fcd81488ba6d39ee0d832117c4f3dfa80dc
SHA256

12a4ea944895e42a8119e7fca3b9e73e881faf774e39b9c9d4d9efb4a19ffb00
SHA512

2ab77aef5e758a7b3018d5c45e60b6154faca92384609902bb2445234a9e8bc526f8a70961a1d8c2acebd68a9bf8b8b6fe7d4a4542a9cf0e53930aa9b30ade80
SSDEEP

96:mqNXqwK188CgAtXvZBkjDf0yf9ysrtWpwwol:mAqrg1XvZB6kYtWpw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	2960	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2960	2272	rundll32.exe	28
PID 2272 wrote to memory of 2960	2272	rundll32.exe	28
PID 2272 wrote to memory of 2960	2272	rundll32.exe	28
PID 2272 wrote to memory of 2960	2272	rundll32.exe	28
PID 2272 wrote to memory of 2960	2272	rundll32.exe	28
PID 2272 wrote to memory of 2960	2272	rundll32.exe	28
PID 2272 wrote to memory of 2960	2272	rundll32.exe	28
PID 2960 wrote to memory of 928	2960	rundll32.exe	29
PID 2960 wrote to memory of 928	2960	rundll32.exe	29
PID 2960 wrote to memory of 928	2960	rundll32.exe	29
PID 2960 wrote to memory of 928	2960	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\advsplash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\advsplash.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 232
    3⤵
    - Program crash
    PID:928