654eebb38506e36b159f0dda7b316e2b726548145a179cec49b32bb030d5aba8

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14-06-2024 10:32

Target

$PLUGINSDIR/System.dll
Size

11KB
MD5

41a3c964232edd2d7d5edea53e8245cd
SHA1

76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206
SHA256

8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5
SHA512

fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1
SSDEEP

192:s/er7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4SyIXe:sQ7Xws4FVWig86/5eCBqSyIXe

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2860	2308	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2204 wrote to memory of 2308	2204	rundll32.exe	28
PID 2308 wrote to memory of 2860	2308	rundll32.exe	29
PID 2308 wrote to memory of 2860	2308	rundll32.exe	29
PID 2308 wrote to memory of 2860	2308	rundll32.exe	29
PID 2308 wrote to memory of 2860	2308	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 224
    3⤵
    - Program crash
    PID:2860