cf2d6159d215863acbe6bb5eccf9fdfb42a89f77c426fc37e876250c54f8a767

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 18:45

Target

$PLUGINSDIR/DLLWebCount_new.dll
Size

28KB
MD5

f16f5feebd9b431a8bc63456c0ad267c
SHA1

acc75cfa3ed7888334aa2ccf305a6c6c58a08aaf
SHA256

5417af0fc8284e9745650a55803bb34217e314096dc7cedf113c960624ae08ad
SHA512

ed1e62d903b511a29abd5def4419b5afa63699ee2d1c91a9d884ffb01d7debe5981559574cac4885140d1f27f4275be56236f5c6f1c327147dcac8893f965512
SSDEEP

96:3YP18J49uJPeaFX/0gOtJ/9nMjbnbk2Zl1bU6i9vtmAuSBudGaTA:3f1bFX/rOtJ/lMvbfJU6snpYdb

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	2368	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2368	2316	rundll32.exe	30
PID 2316 wrote to memory of 2368	2316	rundll32.exe	30
PID 2316 wrote to memory of 2368	2316	rundll32.exe	30
PID 2316 wrote to memory of 2368	2316	rundll32.exe	30
PID 2316 wrote to memory of 2368	2316	rundll32.exe	30
PID 2316 wrote to memory of 2368	2316	rundll32.exe	30
PID 2316 wrote to memory of 2368	2316	rundll32.exe	30
PID 2368 wrote to memory of 1640	2368	rundll32.exe	31
PID 2368 wrote to memory of 1640	2368	rundll32.exe	31
PID 2368 wrote to memory of 1640	2368	rundll32.exe	31
PID 2368 wrote to memory of 1640	2368	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLWebCount_new.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\DLLWebCount_new.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 244
    3⤵
    - Program crash
    PID:1640