e67777b181a1ca1f21890bd0da9b177bcd850498375af8f1b0d3d61c7a54c9d0

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 12:35

Target

$PLUGINSDIR/GdiPlus.dll
Size

1.7MB
MD5

0c38476c6e51c95144f648b78fb579d8
SHA1

1a85ebc7203e7f0dc5297e6c5a056d52d45c447c
SHA256

04495ada069d6d176f14115738782cc8660c575e90046919a02792c274260f02
SHA512

5800fd07a1ab41a14aa1d413d0d2e54583e61086937bbc6b9b8901726f6944fb75fabc45ef1ae44ca9a0b00240c5df50a8a826ce7f2a33581ec21f9fd47be8d1
SSDEEP

24576:uxnzzlD7ReVXjqvyigpv71+h3A6DZq0PCFUm1zfvDf73zJAMd5fUzDHyZ201pKK5:uBzpD700KVwh3TA0PCUuz73aknXKKjN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
820	2320	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2320	2152	rundll32.exe	28
PID 2152 wrote to memory of 2320	2152	rundll32.exe	28
PID 2152 wrote to memory of 2320	2152	rundll32.exe	28
PID 2152 wrote to memory of 2320	2152	rundll32.exe	28
PID 2152 wrote to memory of 2320	2152	rundll32.exe	28
PID 2152 wrote to memory of 2320	2152	rundll32.exe	28
PID 2152 wrote to memory of 2320	2152	rundll32.exe	28
PID 2320 wrote to memory of 820	2320	rundll32.exe	29
PID 2320 wrote to memory of 820	2320	rundll32.exe	29
PID 2320 wrote to memory of 820	2320	rundll32.exe	29
PID 2320 wrote to memory of 820	2320	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GdiPlus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GdiPlus.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 220
    3⤵
    - Program crash
    PID:820