060a13671e38ad7d1326fe38ad16fa81ab23a786ccebe22b3983f1a1570750eb

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 04:00

Target

$PLUGINSDIR/System.dll
Size

25KB
MD5

4da858aae2a92065ecbd4d1b8cdb7c1b
SHA1

90765be6027f29128e3d2dcaeeab5615ab17663e
SHA256

dd11e64dd7ae8e9a3c890912c6bf0afc7ba4a353510a2b85f7b66c4bf66f1d96
SHA512

1798cbbeeef5337f418813240485e27a996021858d0ac548e7cb48303e07785448510e82d689f16ee37c7977288b1dab28edae772bcfd8695698af3ff4489753
SSDEEP

384:hCom2HgN4GbeWmbI4Eybogia7yOe/eMMMK6jYV1B6Dgf2hL:hCR2ACu54HogLebKg21B6Uf2hL

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2216	2076	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2076	2564	rundll32.exe	28
PID 2564 wrote to memory of 2076	2564	rundll32.exe	28
PID 2564 wrote to memory of 2076	2564	rundll32.exe	28
PID 2564 wrote to memory of 2076	2564	rundll32.exe	28
PID 2564 wrote to memory of 2076	2564	rundll32.exe	28
PID 2564 wrote to memory of 2076	2564	rundll32.exe	28
PID 2564 wrote to memory of 2076	2564	rundll32.exe	28
PID 2076 wrote to memory of 2216	2076	rundll32.exe	29
PID 2076 wrote to memory of 2216	2076	rundll32.exe	29
PID 2076 wrote to memory of 2216	2076	rundll32.exe	29
PID 2076 wrote to memory of 2216	2076	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 224
    3⤵
    - Program crash
    PID:2216