5d69d2238d1ffe8d41093c10c64aaaade2e74e6a1ee0bcdd3f554e027efd3b74

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 03:22

Target

$PLUGINSDIR/DLLDownLoader.dll
Size

28KB
MD5

0d613461983c6a2ed1be2e57b67e3ec7
SHA1

274e134bff3a1cc2b15b84f5c7d42f039ce0504f
SHA256

cb0b9edbf618082037aee9c618a7e28da3f66fa01210b425c08ddacd65bdc44c
SHA512

cbf8f2d9612740ab697ed495011cd7ffe2a6873f229374c0d0bc034bdfdfe07d5f65d8f6b6835db52ed8c133bfe141ff5bf08c23065902701cfa90c468b8911d
SSDEEP

96:t+RBpCB8OnNWxYeUXiJsVgcAOErirmYDi1w32wJVoilgtxMTuRQTGo1Qlo:t+RKDnYUPScymr1lGwJigaxMTZTNGu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2228	860	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 860	2236	rundll32.exe	28
PID 2236 wrote to memory of 860	2236	rundll32.exe	28
PID 2236 wrote to memory of 860	2236	rundll32.exe	28
PID 2236 wrote to memory of 860	2236	rundll32.exe	28
PID 2236 wrote to memory of 860	2236	rundll32.exe	28
PID 2236 wrote to memory of 860	2236	rundll32.exe	28
PID 2236 wrote to memory of 860	2236	rundll32.exe	28
PID 860 wrote to memory of 2228	860	rundll32.exe	29
PID 860 wrote to memory of 2228	860	rundll32.exe	29
PID 860 wrote to memory of 2228	860	rundll32.exe	29
PID 860 wrote to memory of 2228	860	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLDownLoader.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLDownLoader.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 252
    3⤵
    - Program crash
    PID:2228