a337a3840f5cc454208fb90d6624ceb98607088b5f91ea2fa2ed8597c6ba2f61

Analysis

max time kernel
14s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 07:48

Target

$PLUGINSDIR/inetc.dll
Size

18KB
MD5

d10b6bf2a8e89632a9a25eeb056bd1fb
SHA1

dc8585c46bb9bf33d244a6c9b83790c94023d9fa
SHA256

e72ed04c48dd5e980639e4cf016e69c193d9a3016f847b6aa158131905688827
SHA512

f23e98eebb367de3a69e695c355340b93b9949236244c630e2b8cfb2dab79ef38372c7d44faeafa5731a88a717c19ed9ab60f11274c1c3cc4fdc794ded12a079
SSDEEP

384:63YVNNhROv8F5EQT5ctuTflwqC7k49/fUya9zn0Ac9khYLMkIX0+GMhg52:6EW8F5EQ8OflwFNJDa9z

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1560	2456	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2456	1932	rundll32.exe	30
PID 1932 wrote to memory of 2456	1932	rundll32.exe	30
PID 1932 wrote to memory of 2456	1932	rundll32.exe	30
PID 1932 wrote to memory of 2456	1932	rundll32.exe	30
PID 1932 wrote to memory of 2456	1932	rundll32.exe	30
PID 1932 wrote to memory of 2456	1932	rundll32.exe	30
PID 1932 wrote to memory of 2456	1932	rundll32.exe	30
PID 2456 wrote to memory of 1560	2456	rundll32.exe	31
PID 2456 wrote to memory of 1560	2456	rundll32.exe	31
PID 2456 wrote to memory of 1560	2456	rundll32.exe	31
PID 2456 wrote to memory of 1560	2456	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\inetc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 240
    3⤵
    - Program crash
    PID:1560