74461cd68eeb147415c70630eddeb77c7fa284a363e9f77a37654ef4bb2d4e96

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 16:46

Target

$PLUGINSDIR/linker.dll
Size

7KB
MD5

682a585176f3efa7bbce1a131994b42b
SHA1

9ec41818616463803d874d114255537f5b35f17e
SHA256

bffd0dbef8711e4cd4575c5292090e0e14f5f0d1f78ad7082c43de7764018547
SHA512

36dfb4aecb1bbfe856f5b9c5aa3e3d902459e1bdc4da632fd6c2acdce27f9db69447432760209737b1030cf3382eecac0401d6df217bf15ed9b0c5f178f6cda6
SSDEEP

96:884yR0JXrtvuQ9OqHrasvGCQg2nl4zmfY2bk/gk:NR0Jrr9RHWsuCQg7ziY2bTk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2908	2244	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2240 wrote to memory of 2244	2240	rundll32.exe	28
PID 2244 wrote to memory of 2908	2244	rundll32.exe	29
PID 2244 wrote to memory of 2908	2244	rundll32.exe	29
PID 2244 wrote to memory of 2908	2244	rundll32.exe	29
PID 2244 wrote to memory of 2908	2244	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\linker.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\linker.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 224
    3⤵
    - Program crash
    PID:2908