a827aeef1409269f76c80f60250f45b379cd688e6800c14bd767478dcdfdfb75

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 09:45

Target

$PLUGINSDIR/wingfavi.dll
Size

1.6MB
MD5

96c2faa6800f061e2e03f6368b12dad4
SHA1

43a339e298e6786dff59c68d2ab6793fe34bc6a0
SHA256

f5d055f3ec74394ea4e988d9476b00107542bfc40032b6bf99b5662c42c33b98
SHA512

a283c3ebb906f0d6d6b43d4f99da851c9ad6884676da7e9c9dfcd809c4563f1e562e03cde4c9b76e1ad75fb0c784ebcbf5d17a81fdf59d4b99d5d95fcf70111f
SSDEEP

49152:q4riMwYihpeVd9dwfCmky77XZp+zNVZeg0mFUqfo07xXm:qjMIhpeVndwfCmky77pEzNVZeE6Co07g

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2028	1716	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1716	1512	rundll32.exe	30
PID 1512 wrote to memory of 1716	1512	rundll32.exe	30
PID 1512 wrote to memory of 1716	1512	rundll32.exe	30
PID 1512 wrote to memory of 1716	1512	rundll32.exe	30
PID 1512 wrote to memory of 1716	1512	rundll32.exe	30
PID 1512 wrote to memory of 1716	1512	rundll32.exe	30
PID 1512 wrote to memory of 1716	1512	rundll32.exe	30
PID 1716 wrote to memory of 2028	1716	rundll32.exe	31
PID 1716 wrote to memory of 2028	1716	rundll32.exe	31
PID 1716 wrote to memory of 2028	1716	rundll32.exe	31
PID 1716 wrote to memory of 2028	1716	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\wingfavi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\wingfavi.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 264
    3⤵
    - Program crash
    PID:2028