a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:22

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

329f721e5109a9731f114c58c03ca6d1
SHA1

a2b346099a35792d80e1dfe8f408695ef07e05b5
SHA256

6a8aaa3940cc292bdc61603f51c2f8328a8d1614b998485e0de08347631615b6
SHA512

b6eedc986dd80157541be4d65490d0df2ef6ab3248800fb15e23f517ebcff3687c4d4cc51908cd779b50db5d76da6c946f4a05ddc79405248dd91566547cd7ca

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	2208	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 2208	288	rundll32.exe	28
PID 288 wrote to memory of 2208	288	rundll32.exe	28
PID 288 wrote to memory of 2208	288	rundll32.exe	28
PID 288 wrote to memory of 2208	288	rundll32.exe	28
PID 288 wrote to memory of 2208	288	rundll32.exe	28
PID 288 wrote to memory of 2208	288	rundll32.exe	28
PID 288 wrote to memory of 2208	288	rundll32.exe	28
PID 2208 wrote to memory of 2072	2208	rundll32.exe	29
PID 2208 wrote to memory of 2072	2208	rundll32.exe	29
PID 2208 wrote to memory of 2072	2208	rundll32.exe	29
PID 2208 wrote to memory of 2072	2208	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 224
    3⤵
    - Program crash
    PID:2072