e6bfb7639093ec2c3f833976fc5bfcf9fd1a1a0adf6d2f4e6f6ec89bed3b2315

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 13:53

Target

$PLUGINSDIR/TypeLib.dll
Size

3KB
MD5

fac3bf746ee0373518766babaa3ffc84
SHA1

e6bc48da23795af39677f799535393ed78aa7ba0
SHA256

2fbefb2d0528f9f4d8a104595ea4595542e718427c8fc08169fb133af0c99990
SHA512

eb4bf74ae449c4673f427344f783cec59c22dcbee1d85835ce8bb6358ff766e6e50d99a1887135daae043d975df5ac2373a8c1334e6b542e0b15765a142f73be

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	2880	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2880	2760	rundll32.exe	30
PID 2760 wrote to memory of 2880	2760	rundll32.exe	30
PID 2760 wrote to memory of 2880	2760	rundll32.exe	30
PID 2760 wrote to memory of 2880	2760	rundll32.exe	30
PID 2760 wrote to memory of 2880	2760	rundll32.exe	30
PID 2760 wrote to memory of 2880	2760	rundll32.exe	30
PID 2760 wrote to memory of 2880	2760	rundll32.exe	30
PID 2880 wrote to memory of 2868	2880	rundll32.exe	31
PID 2880 wrote to memory of 2868	2880	rundll32.exe	31
PID 2880 wrote to memory of 2868	2880	rundll32.exe	31
PID 2880 wrote to memory of 2868	2880	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TypeLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TypeLib.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 224
    3⤵
    - Program crash
    PID:2868