a827aeef1409269f76c80f60250f45b379cd688e6800c14bd767478dcdfdfb75

Analysis

max time kernel
17s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 09:45

Target

$PLUGINSDIR/svrreg.dll
Size

1.5MB
MD5

9984d4d8a4d912e4a1c34dd9324e2356
SHA1

7693138b480aa2bfae44b3b07649f30e09ae7e62
SHA256

e9133b9aff90f271881fefa99f562fbd2860d874e723f5945e72d04b9d6b2474
SHA512

28cd31da030b0ea13e7b96b1bd3e41f61e4c54fba63c9c650c5409ca669c16698a5610e126dca26d6de61e80d70f01b37183b8a82ccb2a75e54b6e4b6d9799f7
SSDEEP

24576:zL6B4nqJax6gF2+sGv6tPQ0hqNKo43duJFYxu1BJDVoR/FFATtMLX5CyXnxwYM7b:36B4nqJa1F2xo6tY5NS3dk1BJZojrIED

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1092	1072	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1072	2504	rundll32.exe	29
PID 2504 wrote to memory of 1072	2504	rundll32.exe	29
PID 2504 wrote to memory of 1072	2504	rundll32.exe	29
PID 2504 wrote to memory of 1072	2504	rundll32.exe	29
PID 2504 wrote to memory of 1072	2504	rundll32.exe	29
PID 2504 wrote to memory of 1072	2504	rundll32.exe	29
PID 2504 wrote to memory of 1072	2504	rundll32.exe	29
PID 1072 wrote to memory of 1092	1072	rundll32.exe	30
PID 1072 wrote to memory of 1092	1072	rundll32.exe	30
PID 1072 wrote to memory of 1092	1072	rundll32.exe	30
PID 1072 wrote to memory of 1092	1072	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\svrreg.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\svrreg.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 252
    3⤵
    - Program crash
    PID:1092