4222bfb7bd45da389ac06f9192129de11a2d59cfcf825a1fed04d882296de572

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 19:32

Target

$PLUGINSDIR/advsplash.dll
Size

5KB
MD5

ca60ae514320a0bfc4991c1fca3dc4ce
SHA1

c0d7db92c979d75233db185f18dee0c9518dd8ae
SHA256

08d2283396141ae8222c6959a0e1b4f75a75a3f2643b33d6d1c9b90d0669c606
SHA512

8e2d00909828b2f527bed1d2dae39e991142091cda8e80fb512ef2790fdd8146e6222dc1a98730af864b1437eab9f0e881e9adc3aad4e6c67f840dc3c4115a3b
SSDEEP

96:+JVdCWbnbRurMwGFhcIeJaWBkUhW9dfrZ8:+t1bRKMpn+NGUhW9Rr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2416	2400	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2400	1200	rundll32.exe	28
PID 1200 wrote to memory of 2400	1200	rundll32.exe	28
PID 1200 wrote to memory of 2400	1200	rundll32.exe	28
PID 1200 wrote to memory of 2400	1200	rundll32.exe	28
PID 1200 wrote to memory of 2400	1200	rundll32.exe	28
PID 1200 wrote to memory of 2400	1200	rundll32.exe	28
PID 1200 wrote to memory of 2400	1200	rundll32.exe	28
PID 2400 wrote to memory of 2416	2400	rundll32.exe	29
PID 2400 wrote to memory of 2416	2400	rundll32.exe	29
PID 2400 wrote to memory of 2416	2400	rundll32.exe	29
PID 2400 wrote to memory of 2416	2400	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\advsplash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\advsplash.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 232
    3⤵
    - Program crash
    PID:2416