28293dada3c88336b2b53aca00adf59f85cabf1362f8386a8ffc6be5e1742836

Resubmissions

11/06/2024, 14:28

11/06/2024, 14:24

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 14:28

Target
$PLUGINSDIR/StartMenu.dll
Size 7KB
Sample240611-rtesjszflf
SHA256 c91c61861cf22d1e9cd14dbba163573b2bd3d03dc72fcb1512879e4f3ab3b276
MD5 6b7073967487c24d08e88c208a1626fa
SHA1 f75f9dd095558b3c03b1647fe23c0869634bd9cc
SHA512 31e1962b761bb0304905287f8ef33bf244b05ce1490723b98134dff0cc55956295d979086c350457fa5f6618868e431f1fc2d34afb4437ada15839ae4836f6f7
SSDEEP 96:d8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/b3lkCTcaqHCI:eZIKXgk+cx6QYFkALlncviI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2096	2884	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2884	2660	rundll32.exe	28
PID 2660 wrote to memory of 2884	2660	rundll32.exe	28
PID 2660 wrote to memory of 2884	2660	rundll32.exe	28
PID 2660 wrote to memory of 2884	2660	rundll32.exe	28
PID 2660 wrote to memory of 2884	2660	rundll32.exe	28
PID 2660 wrote to memory of 2884	2660	rundll32.exe	28
PID 2660 wrote to memory of 2884	2660	rundll32.exe	28
PID 2884 wrote to memory of 2096	2884	rundll32.exe	29
PID 2884 wrote to memory of 2096	2884	rundll32.exe	29
PID 2884 wrote to memory of 2096	2884	rundll32.exe	29
PID 2884 wrote to memory of 2096	2884	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 220
    3⤵
    - Program crash
    PID:2096