5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 10:49

Target

Plugins/InputText.dll
Size

23KB
MD5

d4a3ccfa86889eca3b7cb333e33257ac
SHA1

2a0b39115b1d20457c67e082ff32d84e61ebb26b
SHA256

f35770dde8d01b7e10f969aa1202155b8b0bed9c29c4f8b40d7e683ebe73d0ab
SHA512

65ed0b36cb181b75478b50d5880e7301dd32c8933fc43d95a346a49b9fe69d8efd7bb67719e030ea79079034b7d04737fa12ebd4ba08299169a44ee03769ca1e
SSDEEP

384:ALTJ6I2BatWSdduVbdJjgaseXPG69d4NjU7J:AvJ6/atWSdYM+esjl

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3052	2264	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2264	1844	rundll32.exe	28
PID 1844 wrote to memory of 2264	1844	rundll32.exe	28
PID 1844 wrote to memory of 2264	1844	rundll32.exe	28
PID 1844 wrote to memory of 2264	1844	rundll32.exe	28
PID 1844 wrote to memory of 2264	1844	rundll32.exe	28
PID 1844 wrote to memory of 2264	1844	rundll32.exe	28
PID 1844 wrote to memory of 2264	1844	rundll32.exe	28
PID 2264 wrote to memory of 3052	2264	rundll32.exe	29
PID 2264 wrote to memory of 3052	2264	rundll32.exe	29
PID 2264 wrote to memory of 3052	2264	rundll32.exe	29
PID 2264 wrote to memory of 3052	2264	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\InputText.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\InputText.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 612
    3⤵
    - Program crash
    PID:3052

memory/2264-0-0x0000000002270000-0x00000000022B0000-memory.dmp

Filesize
256KB

Download
memory/2264-1-0x0000000073E9E000-0x0000000073E9F000-memory.dmp

Filesize
4KB

Download
memory/2264-2-0x00000000002E0000-0x00000000002EE000-memory.dmp

Filesize
56KB

Download
memory/2264-3-0x00000000746F0000-0x00000000746FE000-memory.dmp

Filesize
56KB

Download
memory/2264-4-0x0000000002270000-0x00000000022B0000-memory.dmp

Filesize
256KB

Download