75df84ce51fba958aabc1d460c40406083753dfe8a66d7b4b8fb4c65675db1ad

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 21:16

Target

$PLUGINSDIR/System.dll
Size

10KB
MD5

bf01b2d04e8fad306ba2f364cfc4edfa
SHA1

58f42b45ca9fc1818c4498ecd8bac088d20f2b18
SHA256

d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903
SHA512

30ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7
SSDEEP

192:aO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1angMO:vKAFERdlxhGRYUzqZan

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	2732	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2732	2724	rundll32.exe	30
PID 2724 wrote to memory of 2732	2724	rundll32.exe	30
PID 2724 wrote to memory of 2732	2724	rundll32.exe	30
PID 2724 wrote to memory of 2732	2724	rundll32.exe	30
PID 2724 wrote to memory of 2732	2724	rundll32.exe	30
PID 2724 wrote to memory of 2732	2724	rundll32.exe	30
PID 2724 wrote to memory of 2732	2724	rundll32.exe	30
PID 2732 wrote to memory of 2812	2732	rundll32.exe	31
PID 2732 wrote to memory of 2812	2732	rundll32.exe	31
PID 2732 wrote to memory of 2812	2732	rundll32.exe	31
PID 2732 wrote to memory of 2812	2732	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 228
    3⤵
    - Program crash
    PID:2812