16e04f642c910df87e272e0d1ef2c908f7796963556fb6b4b31ed1a348ae6dd9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 21:09

Target

$PLUGINSDIR/InetLoad.dll
Size

56KB
MD5

e6d7772e688dd2ffc8781808d49145e0
SHA1

32deca46c33bccb9121b61c8ead30e81724f5043
SHA256

d4656c404571a99ceef0fd80b6937915938e764e1f1703f8b751d9b7e116dedc
SHA512

8334289a730f5bcae8953c2d24e0bf17a8909af2b4a14e9b92886847d4a9af477ff6dcac7e6e9817591be3c2a15c0029000ceb65b987d729f49a0b278c4a59dc
SSDEEP

768:XFK/Ar4/gfPHMj3/+O+gwc9FqYbgTSfPQpPxQaa5jc2e:XI/AraKPMjJ9Fqqg+oO5B

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	1908	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 2084 wrote to memory of 1908	2084	rundll32.exe	28
PID 1908 wrote to memory of 1984	1908	rundll32.exe	29
PID 1908 wrote to memory of 1984	1908	rundll32.exe	29
PID 1908 wrote to memory of 1984	1908	rundll32.exe	29
PID 1908 wrote to memory of 1984	1908	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoad.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 232
    3⤵
    - Program crash
    PID:1984