41696d0bff91e1ca5b83c99bc1528ecd893e127afb4555a9391e5313c73b51b3

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/06/2024, 12:27

Target
$PLUGINSDIR/ExtractDLLEx.dll
Size 7KB
Sample240621-pmw25stcnk
SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
MD5 ba4063f437abb349aa9120e9c320c467
SHA1 b045d785f6041e25d6be031ae2af4d4504e87b12
SHA512 48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a
SSDEEP 96:lyEPmi/06iLbX8SIP59L1MmqPbgkk/eWKCHGojGYYIF/ggiomsTeZUzI:lyEPmymbMbPZOz+/eWJmoUItiopTeZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2396	3008	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3008	2916	rundll32.exe	28
PID 2916 wrote to memory of 3008	2916	rundll32.exe	28
PID 2916 wrote to memory of 3008	2916	rundll32.exe	28
PID 2916 wrote to memory of 3008	2916	rundll32.exe	28
PID 2916 wrote to memory of 3008	2916	rundll32.exe	28
PID 2916 wrote to memory of 3008	2916	rundll32.exe	28
PID 2916 wrote to memory of 3008	2916	rundll32.exe	28
PID 3008 wrote to memory of 2396	3008	rundll32.exe	29
PID 3008 wrote to memory of 2396	3008	rundll32.exe	29
PID 3008 wrote to memory of 2396	3008	rundll32.exe	29
PID 3008 wrote to memory of 2396	3008	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExtractDLLEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExtractDLLEx.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 224
    3⤵
    - Program crash
    PID:2396