e1b2e96bb57c7afc2c5a7d4bf84a58d360e7363eaa71427d6360829130b1d7c6

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 04:15

Target
$PLUGINSDIR/UAC.dll
Size 36KB
Sample240611-evdknavbpp
SHA256 07ad34100502d7aebd8c19cf6fabda31814312984ae25d26b081ddebf3926077
MD5 e6ab90ea8f9454d4a8aed70eb924bb4a
SHA1 22d7c541e93e3d5520756047e3af0324af7640e5
SHA512 23953f4163afe3a2ebadbba03e7bec5bab10c8c112ab093e3893ec11d6d4232a526014f02db995b60f63b7cc8e49f2883a6e2112092176ccfa28a45f2397527a
SSDEEP 768:4mlFrRNxK9CxHpR2fYw4G3ridSzSH7YHJ2I5:4kFrFJpR2AhGcYB5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2972	3056	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 3056	2604	rundll32.exe	28
PID 2604 wrote to memory of 3056	2604	rundll32.exe	28
PID 2604 wrote to memory of 3056	2604	rundll32.exe	28
PID 2604 wrote to memory of 3056	2604	rundll32.exe	28
PID 2604 wrote to memory of 3056	2604	rundll32.exe	28
PID 2604 wrote to memory of 3056	2604	rundll32.exe	28
PID 2604 wrote to memory of 3056	2604	rundll32.exe	28
PID 3056 wrote to memory of 2972	3056	rundll32.exe	29
PID 3056 wrote to memory of 2972	3056	rundll32.exe	29
PID 3056 wrote to memory of 2972	3056	rundll32.exe	29
PID 3056 wrote to memory of 2972	3056	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 224
    3⤵
    - Program crash
    PID:2972

memory/3056-0-0x000000006A180000-0x000000006A190000-memory.dmp

Download