77763018072adb9e864f06deac9ae588a7ec4ea1a112f9f82c6201d5b7973e84

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 08:30

Target

$PLUGINSDIR/UserInfo.dll
Size

4KB
MD5

1e8e11f465afdabe97f529705786b368
SHA1

ea42bed65df6618c5f5648567d81f3935e70a2a0
SHA256

7d099352c82612ab27ddfd7310c1aa049b58128fb04ea6ea55816a40a6f6487b
SHA512

16566a8c1738e26962139aae893629098dc759e4ac87df3e8eb9819df4e0e422421836bb1e4240377e00fb2f4408ce40f40eee413d0f6dd2f3a4e27a52d49a0b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	2976	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2976	2740	rundll32.exe	28
PID 2740 wrote to memory of 2976	2740	rundll32.exe	28
PID 2740 wrote to memory of 2976	2740	rundll32.exe	28
PID 2740 wrote to memory of 2976	2740	rundll32.exe	28
PID 2740 wrote to memory of 2976	2740	rundll32.exe	28
PID 2740 wrote to memory of 2976	2740	rundll32.exe	28
PID 2740 wrote to memory of 2976	2740	rundll32.exe	28
PID 2976 wrote to memory of 2668	2976	rundll32.exe	29
PID 2976 wrote to memory of 2668	2976	rundll32.exe	29
PID 2976 wrote to memory of 2668	2976	rundll32.exe	29
PID 2976 wrote to memory of 2668	2976	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 224
    3⤵
    - Program crash
    PID:2668