1a028c1f767f9679d38376a35befb6e10627bd34e1dc7b226eaf0dd696dde1e4

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 09:02

Target

$PLUGINSDIR/System.dll
Size

11KB
MD5

f55b41485cbaf292389a52f8e4f0594b
SHA1

89e9b0d1291fa78a40cab358553c447cbbeaa130
SHA256

f16bc2ceb7a6bc7df0955530e72b0aa072ce27650c5cf7b33fd4ea82dea196fc
SHA512

938e8661b8cf418608156dc813c1eb0cc3fa5efa9483061a152bb103c4d821d5c6a82d4c110729e9686f99ccd4da188aebb38a85a01d8ecadb34bb9f6ba60d09
SSDEEP

192:uDKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQbfSF:uViJrtFRdbmXK8+Wfw

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1496	2580	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2580	1572	rundll32.exe	30
PID 1572 wrote to memory of 2580	1572	rundll32.exe	30
PID 1572 wrote to memory of 2580	1572	rundll32.exe	30
PID 1572 wrote to memory of 2580	1572	rundll32.exe	30
PID 1572 wrote to memory of 2580	1572	rundll32.exe	30
PID 1572 wrote to memory of 2580	1572	rundll32.exe	30
PID 1572 wrote to memory of 2580	1572	rundll32.exe	30
PID 2580 wrote to memory of 1496	2580	rundll32.exe	31
PID 2580 wrote to memory of 1496	2580	rundll32.exe	31
PID 2580 wrote to memory of 1496	2580	rundll32.exe	31
PID 2580 wrote to memory of 1496	2580	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 224
    3⤵
    - Program crash
    PID:1496