62785bfab54aff8b4099c82fb0e47513803f90b424fe7aa60c4c3130e43094cd

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15-06-2024 06:05

Target

$PLUGINSDIR/xml.dll
Size

182KB
MD5

ebce8f5e440e0be57665e1e58dfb7425
SHA1

573dc1abd2b03512f390f569058fd2cf1d02ce91
SHA256

d1aaacc0aaf477b6b9f084697adcb444fc2333b32e8d99d224dca89516e762a7
SHA512

4786c9124973b6543d7291047d4c4a06c05282a3766212dbd3b8ce9b9560afddca20c491f791db2258c14ab767d5d3f480daa4706492949eae2ceb4a35aaef85
SSDEEP

3072:Slq7cnzRLdesQbC7ojAqmiGxKUQ8hJgWWHFbit4Gs43YSIFWt:SlYcnzRL8BbwojAzRRQ8hJxahif5wE

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3044	3040	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 3040	3008	rundll32.exe	28
PID 3008 wrote to memory of 3040	3008	rundll32.exe	28
PID 3008 wrote to memory of 3040	3008	rundll32.exe	28
PID 3008 wrote to memory of 3040	3008	rundll32.exe	28
PID 3008 wrote to memory of 3040	3008	rundll32.exe	28
PID 3008 wrote to memory of 3040	3008	rundll32.exe	28
PID 3008 wrote to memory of 3040	3008	rundll32.exe	28
PID 3040 wrote to memory of 3044	3040	rundll32.exe	29
PID 3040 wrote to memory of 3044	3040	rundll32.exe	29
PID 3040 wrote to memory of 3044	3040	rundll32.exe	29
PID 3040 wrote to memory of 3044	3040	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\xml.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 224
    3⤵
    - Program crash
    PID:3044