862698a7b44144ef7d3c54101086ba54f7003b8fc5d3eb86de05a27c6a009a27

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 20:59

Target

$PLUGINSDIR/System.dll
Size

25KB
MD5

0c74aa73312575815c132b40713c6a46
SHA1

eae055959090f8b3b213147a317473e115e5b50f
SHA256

b5677ff9d332b135e7e2cda89e2049c4f7fa19deb20551fc6611facbdc656fd4
SHA512

28b5abe37ebb7723764d11c90dc205e3ef29126f5b7221826fedcd813a512756c5fcbb875961aa80b622e92161a99309d5af7d88390bf48bf5acb1b6dd38ce3d
SSDEEP

384:kZyRQ9dweQ9XYD/isN7lCEjgw4U/ktKi+RIcq1uCJOz3zPPPPPIDv+do01n:kR9dYIrx7lC7TU/kaG1uCJ43Ub

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2168	2412	rundll32.exe	31
PID 2412 wrote to memory of 2168	2412	rundll32.exe	31
PID 2412 wrote to memory of 2168	2412	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2412 -s 112
  2⤵
  PID:2168

memory/2412-0-0x000007FEFB4C0000-0x000007FEFB4CF000-memory.dmp

Filesize
60KB

Download