9b73f8eb1505799749b1b15c7a9ed63448f6b7658a2ef912dc4ce2b57b38ad7d

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 01:38

Target

$PLUGINSDIR/INetC.dll
Size

235KB
MD5

8ee31a2916657afde78bf5e33fd4bb15
SHA1

ef98d0c6dd7ce6b348a91c683ce9175e56c3a522
SHA256

1d8e76baf1de113c119061bea74ef2e8e684c65c2c9675f93970909f0879cdc8
SHA512

318f5715956e3aacacfeccce920a8cd48998a5cfa65dd933afbfdef57b1675735312060950a7245e5c3e8784a61bcb3e8f9bb10e85774466504f7a7e3526af2b
SSDEEP

3072:8tNXMxiQraqoDDfbrH6ZgxkzStPpwGxqeujXj5Bif/Pa0A:8DXMLaqoDfb6mxk2LqHXj3if/Pa

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	2552	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2552	3012	rundll32.exe	30
PID 3012 wrote to memory of 2552	3012	rundll32.exe	30
PID 3012 wrote to memory of 2552	3012	rundll32.exe	30
PID 3012 wrote to memory of 2552	3012	rundll32.exe	30
PID 3012 wrote to memory of 2552	3012	rundll32.exe	30
PID 3012 wrote to memory of 2552	3012	rundll32.exe	30
PID 3012 wrote to memory of 2552	3012	rundll32.exe	30
PID 2552 wrote to memory of 2100	2552	rundll32.exe	31
PID 2552 wrote to memory of 2100	2552	rundll32.exe	31
PID 2552 wrote to memory of 2100	2552	rundll32.exe	31
PID 2552 wrote to memory of 2100	2552	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\INetC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\INetC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 232
    3⤵
    - Program crash
    PID:2100