c9736cdc4ade9fddb9b293e0366f182f972154d98169b58e532b7905c310bf97

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 06:41

Target
$PLUGINSDIR/UserInfo.dll
Size 4KB
Sample240715-hfsb2ssgrl
SHA256 d0949b4c0640ee6a80db5a7f6d93fc631ed194de197d79bf080ec1752c6f1166
MD5 c051c86f6fa84ac87efb0cf3961950a1
SHA1 f18f4bb803099b80a3a013ecb03fea11cff0ac01
SHA512 6e9de5d07aaed2ac297faa5049d567884d817ed94dece055d96913ac8e497ade6f0ff5c28bae7cc7d3ac41f8795efb9939e6d12061a3c446d5d2a3e2287d49d2
MD5 SHA1 SHA512

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2764	2720	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2396 wrote to memory of 2720	2396	rundll32.exe	30
PID 2720 wrote to memory of 2764	2720	rundll32.exe	31
PID 2720 wrote to memory of 2764	2720	rundll32.exe	31
PID 2720 wrote to memory of 2764	2720	rundll32.exe	31
PID 2720 wrote to memory of 2764	2720	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UserInfo.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 224
    3⤵
    - Program crash
    PID:2764