1684c2d7efc42505f47e901f5293ecf3c181b06bad66760ca8988b7a26af697f

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 11:49

Target

$PLUGINSDIR/moo.dll
Size

108KB
MD5

076a3050150c1887d9a5ef76762ff4a4
SHA1

225adac93a9de5af6ca5646cdaf66c69c821dee4
SHA256

72d94ff0e7b385b21bb5f103f055602b67e3e805408d81859fe5ec93a1dc2c2b
SHA512

66be5077dc0380232f5033f101447c08ae0f8c9b5768b2c3a5ecca9b33d4d3932dc4d5fe4167021736884111ef57f1839bd3525ba04968917591f71ee65ac0c8
SSDEEP

1536:nCBz0TBtjpSkYTCjD1j1Uu8Myf58ic19Kniot2hpZi3FVzBMEwH2qiwALXzPi8S:nCBz0PplYK7iBKKIm3vzLXzq8S

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	2112	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2112	1152	rundll32.exe	28
PID 1152 wrote to memory of 2112	1152	rundll32.exe	28
PID 1152 wrote to memory of 2112	1152	rundll32.exe	28
PID 1152 wrote to memory of 2112	1152	rundll32.exe	28
PID 1152 wrote to memory of 2112	1152	rundll32.exe	28
PID 1152 wrote to memory of 2112	1152	rundll32.exe	28
PID 1152 wrote to memory of 2112	1152	rundll32.exe	28
PID 2112 wrote to memory of 1944	2112	rundll32.exe	29
PID 2112 wrote to memory of 1944	2112	rundll32.exe	29
PID 2112 wrote to memory of 1944	2112	rundll32.exe	29
PID 2112 wrote to memory of 1944	2112	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\moo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\moo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 224
    3⤵
    - Program crash
    PID:1944