d81fdcc0520f1f01645e978ae21fcd7e01887044249d7ee1d0e018a6832320a5

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 19:00

Target

$PLUGINSDIR/InetLoad.dll
Size

18KB
MD5

f37c31e52d78ef073192200a7fd2d43a
SHA1

2cecd5aa9924e9928b0fcbf69167f65e4cd49e74
SHA256

87cb74da17d1d376a4ac44411017017f43816a858e9085c340779b92ce705e71
SHA512

282aba1c61d559a083dfc309ce20dd96aaf471af7d7771a8703ab8ea7f6ccae5a40b1ddc3c98da95f5664a1afdeb5813b19a42a4302ec2af05c168c8eadc4eda
SSDEEP

384:YkwWEILlrHNzG4QAx1Dofrn9l3isW1cyMjPzy0Ac9k+LMkIX1+GnUXzX6p:Yi9HVWADgn9l3isW1rMjPz4rp

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2500	2504	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2480 wrote to memory of 2504	2480	rundll32.exe	30
PID 2504 wrote to memory of 2500	2504	rundll32.exe	31
PID 2504 wrote to memory of 2500	2504	rundll32.exe	31
PID 2504 wrote to memory of 2500	2504	rundll32.exe	31
PID 2504 wrote to memory of 2500	2504	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InetLoad.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 236
    3⤵
    - Program crash
    PID:2500