e11e1d02027ed589370e37310fb3c4e607cc29e305a201dc2cbc04ee94579153

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 04:46

Target

$PLUGINSDIR/LuaXml_lib.dll
Size

11KB
MD5

7292b642bd958aeb7fd7cfd19e45b068
SHA1

19a800620d041634abae5b5d096cb0e87ce4c188
SHA256

90f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
SHA512

bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
SSDEEP

192:YK/pDHjlL5Fv4k0CSigGpV8pVqVyoyhXnX1:N/L5FqCjpV8pVswXnX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	1684	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1684	2296	rundll32.exe	28
PID 2296 wrote to memory of 1684	2296	rundll32.exe	28
PID 2296 wrote to memory of 1684	2296	rundll32.exe	28
PID 2296 wrote to memory of 1684	2296	rundll32.exe	28
PID 2296 wrote to memory of 1684	2296	rundll32.exe	28
PID 2296 wrote to memory of 1684	2296	rundll32.exe	28
PID 2296 wrote to memory of 1684	2296	rundll32.exe	28
PID 1684 wrote to memory of 1984	1684	rundll32.exe	29
PID 1684 wrote to memory of 1984	1684	rundll32.exe	29
PID 1684 wrote to memory of 1984	1684	rundll32.exe	29
PID 1684 wrote to memory of 1984	1684	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaXml_lib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LuaXml_lib.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 224
    3⤵
    - Program crash
    PID:1984

memory/1684-0-0x0000000000160000-0x000000000017D000-memory.dmp

Filesize
116KB

Download
memory/1684-1-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download