62785bfab54aff8b4099c82fb0e47513803f90b424fe7aa60c4c3130e43094cd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 06:05

Target

$PLUGINSDIR/WmiInspector.dll
Size

92KB
MD5

1a0b4ff3847dc729ed2ee669c8ac0519
SHA1

a179ca7c5adabd0e1aaa7fe36309770d774ffa43
SHA256

fe268b2259429b6d5efdae9a5dfe621214b2e2c22f03087b2f5f7132596f9f8d
SHA512

118f82fc4e90a03a18f7dccc1facf35eb5a8f0fe092ce4b4b7b1ddb7987efcc9d50674418e004b992a6be35c5e18e7d659843a1bdce9694e5435060c158cc416
SSDEEP

1536:vRhrWA5HRhMz7n8eA9G9gVoAdqszdwKKEPdLQndOpP6nSBEkD7MvvyIXiD:vnSFjLEPdUdOr4SIX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	1928	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1928	2108	rundll32.exe	28
PID 2108 wrote to memory of 1928	2108	rundll32.exe	28
PID 2108 wrote to memory of 1928	2108	rundll32.exe	28
PID 2108 wrote to memory of 1928	2108	rundll32.exe	28
PID 2108 wrote to memory of 1928	2108	rundll32.exe	28
PID 2108 wrote to memory of 1928	2108	rundll32.exe	28
PID 2108 wrote to memory of 1928	2108	rundll32.exe	28
PID 1928 wrote to memory of 2100	1928	rundll32.exe	29
PID 1928 wrote to memory of 2100	1928	rundll32.exe	29
PID 1928 wrote to memory of 2100	1928	rundll32.exe	29
PID 1928 wrote to memory of 2100	1928	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WmiInspector.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WmiInspector.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 228
    3⤵
    - Program crash
    PID:2100