879a1f5ebda081f1ca1db7750a0c159136288d1185d54fe0b01ee5f62ea169f9

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 00:30

Target

$PLUGINSDIR/System.dll
Size

18KB
MD5

2db076f87de4a7671eb48f9a4ec6c59a
SHA1

fe03da9ffa5ce73fdf4b742861c2dc94449b9e95
SHA256

3a3e51c653a66e42a0422a0cef861f374843d227eb79ea31788d19e1f9d0628d
SHA512

e535171ad7ef18fa275568125dd73135b610faa60a5c15987f639a6ce4af033937e820ba781cdbe1b74c2b55edc36bcce72f6894cd15e254e2b1ca765ce7e901
SSDEEP

384:q/Qlt7wiij/lMRv/9V4bvrFf4c8ZpH3GCJEAZI7i:qaeiijipUviRBEef

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	2432	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2432	2536	rundll32.exe	28
PID 2536 wrote to memory of 2432	2536	rundll32.exe	28
PID 2536 wrote to memory of 2432	2536	rundll32.exe	28
PID 2536 wrote to memory of 2432	2536	rundll32.exe	28
PID 2536 wrote to memory of 2432	2536	rundll32.exe	28
PID 2536 wrote to memory of 2432	2536	rundll32.exe	28
PID 2536 wrote to memory of 2432	2536	rundll32.exe	28
PID 2432 wrote to memory of 3004	2432	rundll32.exe	29
PID 2432 wrote to memory of 3004	2432	rundll32.exe	29
PID 2432 wrote to memory of 3004	2432	rundll32.exe	29
PID 2432 wrote to memory of 3004	2432	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 224
    3⤵
    - Program crash
    PID:3004