61a41bce35be1e2a3bf9081353b2d2ad9aa20694483d226bb04e4fdd8633bcf6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 08:59

Target

$PLUGINSDIR/ComSetup.dll
Size

174KB
MD5

ed1cddf37989bee6a30d0e8367267f6a
SHA1

4d4e8e4f63ded7f70d937dc44182608a1de634e0
SHA256

4d0cd88695cc209b042bd98d682373efa76b3d442d361f92606149a55b09909a
SHA512

a5ddb11af1025ba435d67051eab50f7f0831005e05408acec1a22bd0289a34207f9e0ef8bd6b0b6c2437d76003713b1dbc8b2923461327206ce29cd5f035a5a6
SSDEEP

3072:ZJG0VpirTTOIqN0jae+4wotbrlxU1t54VnFNE:ZJGapiPTOJNe+473f1VF

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	1388	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1388	1872	rundll32.exe	31
PID 1872 wrote to memory of 1388	1872	rundll32.exe	31
PID 1872 wrote to memory of 1388	1872	rundll32.exe	31
PID 1872 wrote to memory of 1388	1872	rundll32.exe	31
PID 1872 wrote to memory of 1388	1872	rundll32.exe	31
PID 1872 wrote to memory of 1388	1872	rundll32.exe	31
PID 1872 wrote to memory of 1388	1872	rundll32.exe	31
PID 1388 wrote to memory of 2340	1388	rundll32.exe	32
PID 1388 wrote to memory of 2340	1388	rundll32.exe	32
PID 1388 wrote to memory of 2340	1388	rundll32.exe	32
PID 1388 wrote to memory of 2340	1388	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ComSetup.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ComSetup.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 232
    3⤵
    - Program crash
    PID:2340