df743df0e6439937a24ab8d5de7deaff63912d8dccdc14fdabcb9404bfe3e5a7

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 10:53

Target

$PLUGINSDIR/inetc.dll
Size

20KB
MD5

9a7d35d1e9e5dfb6a7872d49cf64db83
SHA1

4da9dd5427c0fdfa2cce3ee29ac5147b74ff3834
SHA256

c7a365c50611e7b3bbec6f73e9b33fa83d9ca91c34cde67969cd7cab79293160
SHA512

cb98bc94b883ecd88102a017de484560085c0f70fa379489618cc10c017d543e53b12502a0a7cae49682887676c4c590fc481ab9cd531467b1d090499783db3a
SSDEEP

384:qYJFIiP3ZudtjmSBSWY1IAxNOzqXBrxzs0UhU7ya4LH0Ac9khYLMkIX0+G0cgLGh:qaBcdtjmsSW6IAxNQqXBrx40UhUua4Lx

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1272	2696	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 3016 wrote to memory of 2696	3016	rundll32.exe	30
PID 2696 wrote to memory of 1272	2696	rundll32.exe	31
PID 2696 wrote to memory of 1272	2696	rundll32.exe	31
PID 2696 wrote to memory of 1272	2696	rundll32.exe	31
PID 2696 wrote to memory of 1272	2696	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 236
    3⤵
    - Program crash
    PID:1272