f0312bb0e825e5786d08e93f63c1880fbae8f8cbc45f0955e2ea74becc3ef27e

Analysis

max time kernel
141s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 11:31

Target

plugins/ImpREC.dll
Size

50KB
MD5

8b623ade9d85e81f754ba49c72cf6789
SHA1

d19279e325bc8970055602a06a469f18f394347c
SHA256

1455c5790afdfd9b1afdc84f2d1f2a0cc3e7162bd2127033e22df9a123066ef4
SHA512

e381761987aaa516225c753fd57853123ed3bbfc94052915892bf4b764b7a9689de058b927b5c347189732299cb6cbfbf709885dcf9f808f6251b57cadeee806
SSDEEP

768:zHMJYKW0fUK+92mkk4w7A5v1a8V/3Zwrd6+QVbzFFwXjjVUHNaDQ+gjbUWRB2bPq:6ZEXt4wA58Q/pwrWVd+j7X9PGr

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	2980	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2980	2160	rundll32.exe	30
PID 2160 wrote to memory of 2980	2160	rundll32.exe	30
PID 2160 wrote to memory of 2980	2160	rundll32.exe	30
PID 2160 wrote to memory of 2980	2160	rundll32.exe	30
PID 2160 wrote to memory of 2980	2160	rundll32.exe	30
PID 2160 wrote to memory of 2980	2160	rundll32.exe	30
PID 2160 wrote to memory of 2980	2160	rundll32.exe	30
PID 2980 wrote to memory of 1952	2980	rundll32.exe	31
PID 2980 wrote to memory of 1952	2980	rundll32.exe	31
PID 2980 wrote to memory of 1952	2980	rundll32.exe	31
PID 2980 wrote to memory of 1952	2980	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\ImpREC.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugins\ImpREC.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 228
    3⤵
    - Program crash
    PID:1952

memory/2980-0-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download
memory/2980-1-0x0000000010000000-0x0000000010026000-memory.dmp

Filesize
152KB

Download