e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 04:15

Target
$PLUGINSDIR/System.dll
Size 24KB
Sample240611-evdknavbpp
SHA256 4263984428f49792f359b91d5eee19b6d248340204051dd14af9a73710967dc7
MD5 6c09648818cf6820a769e8f03c28645d
SHA1 30bf9117443955d50e396a799792746107a282c3
SHA512 f10443c9fa469b778aeb0911f656ebeaadfa4519ba40397775b633da75309f09759745390c27df0be0650988f90716791b6043bb269db3890f9a9171d5666319
SSDEEP 384:Sju1mQpK8SvOWZqoNvRjEJMmG+cGR1J5VPY8cCxfMwdxy:4OWIoN6JMmGUjJLa6xy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1580	2372	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2104 wrote to memory of 2372	2104	rundll32.exe	28
PID 2372 wrote to memory of 1580	2372	rundll32.exe	29
PID 2372 wrote to memory of 1580	2372	rundll32.exe	29
PID 2372 wrote to memory of 1580	2372	rundll32.exe	29
PID 2372 wrote to memory of 1580	2372	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 224
    3⤵
    - Program crash
    PID:1580

memory/2372-0-0x000000006E5C0000-0x000000006E5CD000-memory.dmp

Download