406a9e03ab016d68a3aa919ac67397a83081f3ef478baf752d90545ec0fac6dc

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11-06-2024 18:31

Target

$PLUGINSDIR/System.dll
Size

11KB
MD5

55a26d7800446f1373056064c64c3ce8
SHA1

80256857e9a0a9c8897923b717f3435295a76002
SHA256

904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
SHA512

04b8ab7a85c26f188c0a06f524488d6f2ac2884bf107c860c82e94ae12c3859f825133d78338fd2b594dfc48f7dc9888ae76fee786c6252a5c77c88755128a5b
SSDEEP

192:MPtkumJX7zBE2kGwfy9S9VkPsFQ1Mx1c:97O2k5q9wA1Mxa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2292	1828	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 3028 wrote to memory of 1828	3028	rundll32.exe	28
PID 1828 wrote to memory of 2292	1828	rundll32.exe	29
PID 1828 wrote to memory of 2292	1828	rundll32.exe	29
PID 1828 wrote to memory of 2292	1828	rundll32.exe	29
PID 1828 wrote to memory of 2292	1828	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 224
    3⤵
    - Program crash
    PID:2292