65f6a6e1910cca25ca3c6e6bf41f5a0a9832a6c11cbbba38bbc20291ae47899a

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 12:04

Target

$PLUGINSDIR/Linker.dll
Size

7KB
MD5

4d7bbb06eaba0a221d4f50f868f93d81
SHA1

370cb0655fe5839d430d7edc60de34d127987837
SHA256

fdf83b6cd8df4a202cc698222aaaa9f3e39e9af1bde3d7aeab7b93b98ce0a51a
SHA512

84c98f6dbdf0ba8f96216c05954b907b7c87f1b7502a13989c69d9def9def9c2302ee6dea2ff49b7fdd546a8d0739230d31e5e1353b83cb407c9533cb342850c
SSDEEP

96:ecGy70RHRBXvytUc4Xv9ql5XYXRZpYwCHbk3gv:eY70RHHatj4/MXYXnuVHbLv

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3036 2072 WerFault.exe rundll32.exe

pid	pid_target	process	target process
3036	2072	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2724 wrote to memory of 2072	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 2072	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 2072	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 2072	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 2072	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 2072	2724	rundll32.exe	rundll32.exe
PID 2724 wrote to memory of 2072	2724	rundll32.exe	rundll32.exe
PID 2072 wrote to memory of 3036	2072	rundll32.exe	WerFault.exe
PID 2072 wrote to memory of 3036	2072	rundll32.exe	WerFault.exe
PID 2072 wrote to memory of 3036	2072	rundll32.exe	WerFault.exe
PID 2072 wrote to memory of 3036	2072	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Linker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Linker.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 220
    3⤵
    - Program crash
    PID:3036