755d11ba3943ba14071f4bdb5b10d3a1db96fdbf637a2851317304aa2523a4b4

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 09:12

Target

Plugins/FX/reainsert.dll
Size

29KB
MD5

caec266b2ea12b8318e789cf93c3c39b
SHA1

666d29b06d17ea256670f32375a354a99340bf33
SHA256

ea91906627c64b5afd947ba426950d5136e1a28552f7596cca71890a40505cc5
SHA512

893866b03b6f783da810c4eb85a251505676aa0dacc14ea3a182f3c1936ead6b28802a0545684e4613ecd84c4974d339165fb5ace0806eb1ce96d3d88cf61f13
SSDEEP

384:J12jLCON4K/gz/SvVr275OGlV9DC2XNYtjRLHNHNE+qqwI+YRo:uj+O2qK/4yD7pCgNiVHNHkqwI+Y

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2484	2044	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2044	2236	rundll32.exe	28
PID 2236 wrote to memory of 2044	2236	rundll32.exe	28
PID 2236 wrote to memory of 2044	2236	rundll32.exe	28
PID 2236 wrote to memory of 2044	2236	rundll32.exe	28
PID 2236 wrote to memory of 2044	2236	rundll32.exe	28
PID 2236 wrote to memory of 2044	2236	rundll32.exe	28
PID 2236 wrote to memory of 2044	2236	rundll32.exe	28
PID 2044 wrote to memory of 2484	2044	rundll32.exe	29
PID 2044 wrote to memory of 2484	2044	rundll32.exe	29
PID 2044 wrote to memory of 2484	2044	rundll32.exe	29
PID 2044 wrote to memory of 2484	2044	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reainsert.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\FX\reainsert.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 232
    3⤵
    - Program crash
    PID:2484