76afbad7304f66738d4f26200c7c1eb410a70b0e9a051794d93f836ced3fa387

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 07:47

Target
$PLUGINSDIR/System.dll
Size 11KB
Sample240715-jmrjrswamn
SHA256 aec5af9c7c551c3590492b0c0120b535b55ab048e84f695b617a5ab4b1a52f54
MD5 bff2a11d26d951ec34679b8fa1ee7192
SHA1 d3de629a5a86ee35b6afa1802f6ac8b141b07062
SHA512 1dce397c9cab3cd3b58c181688286a89067c743f195403694819c2d988435268ffd01939beaaa17cfa344160c89414f28273b70de154be0def034af8c470723a
SSDEEP 192:G9rQDenC9VrcK7REgSWOprANupQYLRszDDH/d9CWlXo7U6Wxf:GJQEaVAK7R9SfpjpQYLRszfH/d9CWB1j
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2652	2404	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2924 wrote to memory of 2404	2924	rundll32.exe	31
PID 2404 wrote to memory of 2652	2404	rundll32.exe	32
PID 2404 wrote to memory of 2652	2404	rundll32.exe	32
PID 2404 wrote to memory of 2652	2404	rundll32.exe	32
PID 2404 wrote to memory of 2652	2404	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 220
    3⤵
    - Program crash
    PID:2652