71b96d709cb160b579ec5010ce38b00084a49c420cd5945b69714dfc9acb811e

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 10:06

Target

$PLUGINSDIR/StartMenu.dll
Size

7KB
MD5

4973362a84e11dd8541387ab1694afcc
SHA1

b78a0fe67c07713c7abd9668b881c4bc808d9a7a
SHA256

7757518466b21ce175607f10599f26fff127d59a16dc10bf4ba4b7d83d13d47d
SHA512

65c305eced5cd81fe3a573827d62a33e400f03d5bfcb3b3a503927bc0decaedef5d74e6d1ba25a0601fe812f8d2424887d58211c3f3cea1442643f5d1c23c2fb
SSDEEP

96:Z+nBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5tLGhEl5VN:Z+BepxPE1r8/FtmCDtSg5v

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	2232	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2232	1912	rundll32.exe	30
PID 1912 wrote to memory of 2232	1912	rundll32.exe	30
PID 1912 wrote to memory of 2232	1912	rundll32.exe	30
PID 1912 wrote to memory of 2232	1912	rundll32.exe	30
PID 1912 wrote to memory of 2232	1912	rundll32.exe	30
PID 1912 wrote to memory of 2232	1912	rundll32.exe	30
PID 1912 wrote to memory of 2232	1912	rundll32.exe	30
PID 2232 wrote to memory of 2660	2232	rundll32.exe	31
PID 2232 wrote to memory of 2660	2232	rundll32.exe	31
PID 2232 wrote to memory of 2660	2232	rundll32.exe	31
PID 2232 wrote to memory of 2660	2232	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 224
    3⤵
    - Program crash
    PID:2660