b6073a335b57ff3ba40ee7c74c5b429d135202cbbddd9c04564e542951049a8b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 13:42

Target

$PLUGINSDIR/AdvSplash.dll
Size

6KB
MD5

820a1351ad064f75154b4f768b4d6fa4
SHA1

00d47f11f88be17fa7c94cbf70e72c7f3b257dde
SHA256

36e50c5f900e498b38bb42ea4b7cb14e5cb433807669e56e8c78d9921cf61270
SHA512

9d28325b0df6ab4e469f787cdd9f3bee83a2c98a13c695aac61cee61301ebce84551babc1b7307efd28ca78768293884a39ae7cf3f1ad1f11215691add49528d
SSDEEP

96:nQNyX2PtUZsMGe3SlFaqqhN51xWa5kkEkk/StCewookyc:nFXYtxWSf61vk/kkStCeRt

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2732	2856	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2856	2852	rundll32.exe	30
PID 2852 wrote to memory of 2856	2852	rundll32.exe	30
PID 2852 wrote to memory of 2856	2852	rundll32.exe	30
PID 2852 wrote to memory of 2856	2852	rundll32.exe	30
PID 2852 wrote to memory of 2856	2852	rundll32.exe	30
PID 2852 wrote to memory of 2856	2852	rundll32.exe	30
PID 2852 wrote to memory of 2856	2852	rundll32.exe	30
PID 2856 wrote to memory of 2732	2856	rundll32.exe	31
PID 2856 wrote to memory of 2732	2856	rundll32.exe	31
PID 2856 wrote to memory of 2732	2856	rundll32.exe	31
PID 2856 wrote to memory of 2732	2856	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AdvSplash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AdvSplash.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 232
    3⤵
    - Program crash
    PID:2732