531313033fdb71c44c0791f56679e55c36f06fa6250f90f68ebaf42e7a2a044b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 06:29

Target

$PLUGINSDIR/Protocol.dll
Size

355KB
MD5

a0ec723d41810478bb659a85e4e92f3d
SHA1

24cc9fc77abcafe0dd1c5a4e547a8b4efd63c85f
SHA256

dd57149bfa1348e482afddbbe79187527cbd358cdb3036fdf4e8b9f446d020cf
SHA512

ed98dff026eff8501a526dc36c5f68b63adc5a1704881015d6a9f7af53e5a3a47da6aad8d054b7f7cf0821f479a016f45ad20a1b201c263a09cf8265cd772c4d
SSDEEP

6144:9ibLrat+Zbe/UnSKeWWhaAIMsmg/wQ2h/WS8emoDCnD3h7xKYJd098jOfA7Ku:9uzyXXJaAI+qh4SWDCt7xK00yOu

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2756	2896	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2896	2892	rundll32.exe	30
PID 2892 wrote to memory of 2896	2892	rundll32.exe	30
PID 2892 wrote to memory of 2896	2892	rundll32.exe	30
PID 2892 wrote to memory of 2896	2892	rundll32.exe	30
PID 2892 wrote to memory of 2896	2892	rundll32.exe	30
PID 2892 wrote to memory of 2896	2892	rundll32.exe	30
PID 2892 wrote to memory of 2896	2892	rundll32.exe	30
PID 2896 wrote to memory of 2756	2896	rundll32.exe	31
PID 2896 wrote to memory of 2756	2896	rundll32.exe	31
PID 2896 wrote to memory of 2756	2896	rundll32.exe	31
PID 2896 wrote to memory of 2756	2896	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Protocol.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Protocol.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 324
    3⤵
    - Program crash
    PID:2756