d09cc3c95f4147b65a06a371237d2808fb69386fa59c84c4ec7af7a8f8503fd7

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 19:55

Target

$PLUGINSDIR/GdiPlus.dll
Size

1.7MB
MD5

0c38476c6e51c95144f648b78fb579d8
SHA1

1a85ebc7203e7f0dc5297e6c5a056d52d45c447c
SHA256

04495ada069d6d176f14115738782cc8660c575e90046919a02792c274260f02
SHA512

5800fd07a1ab41a14aa1d413d0d2e54583e61086937bbc6b9b8901726f6944fb75fabc45ef1ae44ca9a0b00240c5df50a8a826ce7f2a33581ec21f9fd47be8d1
SSDEEP

24576:uxnzzlD7ReVXjqvyigpv71+h3A6DZq0PCFUm1zfvDf73zJAMd5fUzDHyZ201pKK5:uBzpD700KVwh3TA0PCUuz73aknXKKjN

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	1644	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1644	2072	rundll32.exe	30
PID 2072 wrote to memory of 1644	2072	rundll32.exe	30
PID 2072 wrote to memory of 1644	2072	rundll32.exe	30
PID 2072 wrote to memory of 1644	2072	rundll32.exe	30
PID 2072 wrote to memory of 1644	2072	rundll32.exe	30
PID 2072 wrote to memory of 1644	2072	rundll32.exe	30
PID 2072 wrote to memory of 1644	2072	rundll32.exe	30
PID 1644 wrote to memory of 2176	1644	rundll32.exe	31
PID 1644 wrote to memory of 2176	1644	rundll32.exe	31
PID 1644 wrote to memory of 2176	1644	rundll32.exe	31
PID 1644 wrote to memory of 2176	1644	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GdiPlus.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GdiPlus.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 224
    3⤵
    - Program crash
    PID:2176