6d6611463a02ae95421da86ea2be11fbeb260fddfdedb20be9561616ff33ced5

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 00:50

Target

$PLUGINSDIR/DcryptDll.dll
Size

10KB
MD5

69dc2ed40717e5a0dfa3feaa902f448e
SHA1

07a6a0b6028a92e0c822cfe9b119aa1e81b28a79
SHA256

73e8489b06789803dcab0f4bcae4281f1477ec652f80714c3b78671f73cfefad
SHA512

f41e457466fcc979864829861bf421ad2589ec6b5afc81d19424f7af285ce1fb7ce25cc4067e53cd379621b5b8098882210e4535a4d53555b7816edcc2186a3c
SSDEEP

192:ytTlNqjCZv12CDkFhrF5+ykYF8IwWzS3+1ZxIujmMAm:MTlEWZEjF5/yIwp3gIuj

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2648	2376	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2376	2120	rundll32.exe	31
PID 2120 wrote to memory of 2376	2120	rundll32.exe	31
PID 2120 wrote to memory of 2376	2120	rundll32.exe	31
PID 2120 wrote to memory of 2376	2120	rundll32.exe	31
PID 2120 wrote to memory of 2376	2120	rundll32.exe	31
PID 2120 wrote to memory of 2376	2120	rundll32.exe	31
PID 2120 wrote to memory of 2376	2120	rundll32.exe	31
PID 2376 wrote to memory of 2648	2376	rundll32.exe	32
PID 2376 wrote to memory of 2648	2376	rundll32.exe	32
PID 2376 wrote to memory of 2648	2376	rundll32.exe	32
PID 2376 wrote to memory of 2648	2376	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DcryptDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DcryptDll.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 224
    3⤵
    - Program crash
    PID:2648

memory/2376-1-0x0000000010007000-0x0000000010008000-memory.dmp

Filesize
4KB

Download
memory/2376-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download