3ce6061c6ba624ee1cfef7e08127aa8e1287c413ea15a0ce174f830920a9582d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 04:35

Target
$PLUGINSDIR/manlib.dll
Size 25KB
Sample240614-e7sv4sygrp
SHA256 5d39bdd81b123645e3f7cc1006deae96dbaaabe71946e235897a50fbb314e125
MD5 94ba775c8a1f4d6c9bb1966eddce22b5
SHA1 4ed1946ecfb758cc0f68aa452401b37454a107d7
SHA512 5f42ac7bd636ed372d4bc8d0c140007e2123cbf82effcacd388d67aedaef54110f9a01463d293016c2487de9f2725cefdc6f4e59e78c1bd6fb3f379e721c6e6e
SSDEEP 384:TVYyb6btb0e4JNvPuzsVAAah1vrmCBeGznQf58bt0Ac9khYLMkIX0+GGxky8oOwb:TVYybKhg2snCBPnQfCb/Ow
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2184	948	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 948	1936	rundll32.exe	28
PID 1936 wrote to memory of 948	1936	rundll32.exe	28
PID 1936 wrote to memory of 948	1936	rundll32.exe	28
PID 1936 wrote to memory of 948	1936	rundll32.exe	28
PID 1936 wrote to memory of 948	1936	rundll32.exe	28
PID 1936 wrote to memory of 948	1936	rundll32.exe	28
PID 1936 wrote to memory of 948	1936	rundll32.exe	28
PID 948 wrote to memory of 2184	948	rundll32.exe	29
PID 948 wrote to memory of 2184	948	rundll32.exe	29
PID 948 wrote to memory of 2184	948	rundll32.exe	29
PID 948 wrote to memory of 2184	948	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\manlib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\manlib.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 236
    3⤵
    - Program crash
    PID:2184