dbb02d406f383ebc2ec118e012abe2c4efea3a21a30f6e60874fe117e57c7714

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/06/2024, 04:35

Target
$PLUGINSDIR/Report.dll
Size 98KB
Sample240617-e7s6waydqq
SHA256 1d697cba0b02f54a5fb5759f0b5feca39dd272a35a8621b14624e9067d78c2db
MD5 5767863541cde6995690b2a00bb32431
SHA1 2960376d507ccee1806fee50453e034486daedf3
SHA512 4cd00cbe833de19fddca291b30c965b8380dcd457dab553008722f92fe4841f2e85a71c09899be63ab42ab48d6621ab4dd88fad530907cd9c7cb993493a0e0cb
SSDEEP 1536:UjR4Zllo5PYpKTQWxrDXQewk0BtXR3nhDtz2g:UjuZjo5PYpKHV0bXRBtz2g
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2848	2828	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2828	1996	rundll32.exe	28
PID 1996 wrote to memory of 2828	1996	rundll32.exe	28
PID 1996 wrote to memory of 2828	1996	rundll32.exe	28
PID 1996 wrote to memory of 2828	1996	rundll32.exe	28
PID 1996 wrote to memory of 2828	1996	rundll32.exe	28
PID 1996 wrote to memory of 2828	1996	rundll32.exe	28
PID 1996 wrote to memory of 2828	1996	rundll32.exe	28
PID 2828 wrote to memory of 2848	2828	rundll32.exe	29
PID 2828 wrote to memory of 2848	2828	rundll32.exe	29
PID 2828 wrote to memory of 2848	2828	rundll32.exe	29
PID 2828 wrote to memory of 2848	2828	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Report.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Report.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 224
    3⤵
    - Program crash
    PID:2848