bca64540a033b12247f730c2afaad55f710c1e5054c297b84ea56e50388079fe

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 04:46

Target

$PLUGINSDIR/fpinstall.dll
Size

3KB
MD5

7d448e856571c3cc9a403d62e429484c
SHA1

75698fd133c13ad2fc8e234254a492d686900dfd
SHA256

5a70946e57565d9e4327d3832f3e2d836608c3c4408394752d690fe9a5687d50
SHA512

903f4564f84fdc4e65f98f0abe99cf18692f349fcc168677b3424bd46d358c0380f8f2f73bb9091f04086698b9795f5b7a6695c60d6b4d6aecae19742468003b

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2744	2464	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30
PID 1824 wrote to memory of 2464	1824	rundll32.exe	30
PID 2464 wrote to memory of 2744	2464	rundll32.exe	31
PID 2464 wrote to memory of 2744	2464	rundll32.exe	31
PID 2464 wrote to memory of 2744	2464	rundll32.exe	31
PID 2464 wrote to memory of 2744	2464	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fpinstall.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\fpinstall.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 224
    3⤵
    - Program crash
    PID:2744