b5a7df1bce14af47db87f45e2ee5c2f53408d181da89d3490298e49714902a03

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 08:52

Target

$PLUGINSDIR/MReport.dll
Size

89KB
MD5

22c91de8e4517c4e8af2cf3ad50a7464
SHA1

e045d5158e108dac4de4365190dbd17ce5b65064
SHA256

5d06bca579f9a7c37d8e319d77db3781f081e11d977ba4689b2765d8ec631a8a
SHA512

8e465d74e95dd4fea905bb622a30a67608bbd0328234b9d03829c043463396aa0c53222e8fc5983d7824590345c377dc766e1dbd10a8a5cb848f396781f89d46
SSDEEP

1536:5tJ+f0gtQ9axFG04j/2XrRBvjD2svI1QUwn4Pk8IqGCAHhRER56mNp:56FG0FzvfvmC43GCAHhOR56A

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2300	2168	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2168	2808	rundll32.exe	30
PID 2808 wrote to memory of 2168	2808	rundll32.exe	30
PID 2808 wrote to memory of 2168	2808	rundll32.exe	30
PID 2808 wrote to memory of 2168	2808	rundll32.exe	30
PID 2808 wrote to memory of 2168	2808	rundll32.exe	30
PID 2808 wrote to memory of 2168	2808	rundll32.exe	30
PID 2808 wrote to memory of 2168	2808	rundll32.exe	30
PID 2168 wrote to memory of 2300	2168	rundll32.exe	31
PID 2168 wrote to memory of 2300	2168	rundll32.exe	31
PID 2168 wrote to memory of 2300	2168	rundll32.exe	31
PID 2168 wrote to memory of 2300	2168	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MReport.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\MReport.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 232
    3⤵
    - Program crash
    PID:2300