19b460ecdd81029cc8a816363dcc8468626eb2a0514f3e34c4189b69c6e02ec7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 13:35

Target

$PLUGINSDIR/UAC.dll
Size

16KB
MD5

acfb66ee6fc1f4266229ec6098fe1740
SHA1

e1aeb31b11996015d7f17308e2f2bbe69d4e1476
SHA256

6d7e8070fa09cc4bb66fb99c2b88d0f5419602fa64a519437f430d9378300b1e
SHA512

bf0b5b22c57c08c88b4cbdd75bdf0c8eac433d42b4d163349391b71bc44d913e4d0e28e0826a7c27b418e6d2aa37c08c90577b56baa946a8f129486fbe01c303
SSDEEP

192:u9ALVfpLcFB5yoMINGXZ8YJJS6gGi21FNZRfUOPwiAGQMAW5s+2oA5D8t8A:SAL/S0xIkZ8CL7hfUOPGMAW5BkDod

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	2384	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2384	2180	rundll32.exe	28
PID 2180 wrote to memory of 2384	2180	rundll32.exe	28
PID 2180 wrote to memory of 2384	2180	rundll32.exe	28
PID 2180 wrote to memory of 2384	2180	rundll32.exe	28
PID 2180 wrote to memory of 2384	2180	rundll32.exe	28
PID 2180 wrote to memory of 2384	2180	rundll32.exe	28
PID 2180 wrote to memory of 2384	2180	rundll32.exe	28
PID 2384 wrote to memory of 2140	2384	rundll32.exe	29
PID 2384 wrote to memory of 2140	2384	rundll32.exe	29
PID 2384 wrote to memory of 2140	2384	rundll32.exe	29
PID 2384 wrote to memory of 2140	2384	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 224
    3⤵
    - Program crash
    PID:2140