a0b02ae9bdc6808aa06ae218f8c74fa9bcbdcc4e651d9cd24570bd6c05d71bcd

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 02:22

Target

$PLUGINSDIR/AlInst.dll
Size

38KB
MD5

1765624eb7554857f03706c4e46f874d
SHA1

800063960ced61c1a61ec0f1aaa5e3ed47dd98e5
SHA256

911fe5e87465dcfd461306dca31f8b60bf8d3be94d9fd2da2c91efc1bbc143a7
SHA512

7de4ae16776f9e63a29de1427a6a8779ab6e32a2bc9254aae93da27164c698bc314cb7fcce8b6966a5145ea4404fbcea33f2671dc862c46260fe9f6fd24d366c
SSDEEP

768:RKx16KKMgaAHxVMdykDSfcu17DpNbmLJKRDrF4yilpoA:RW16KKMgaAH3aO/pZmLJkUlp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2204	1724	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1724	2028	rundll32.exe	28
PID 2028 wrote to memory of 1724	2028	rundll32.exe	28
PID 2028 wrote to memory of 1724	2028	rundll32.exe	28
PID 2028 wrote to memory of 1724	2028	rundll32.exe	28
PID 2028 wrote to memory of 1724	2028	rundll32.exe	28
PID 2028 wrote to memory of 1724	2028	rundll32.exe	28
PID 2028 wrote to memory of 1724	2028	rundll32.exe	28
PID 1724 wrote to memory of 2204	1724	rundll32.exe	29
PID 1724 wrote to memory of 2204	1724	rundll32.exe	29
PID 1724 wrote to memory of 2204	1724	rundll32.exe	29
PID 1724 wrote to memory of 2204	1724	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AlInst.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AlInst.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 244
    3⤵
    - Program crash
    PID:2204