7c5b449226d2c3e8e65341baffb10b9393282d53b7f6fb164ed788ca2967bb99

Analysis

max time kernel
141s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 23:59

Target
$PLUGINSDIR/StartMenu.dll
Size 11KB
Sample240930-31pf4s1cpr
SHA256 48765294aa273ec2fd55cc5f9301e138b4d56a9f6d00fcf24473788e64b52bfd
MD5 65c301d9a85f4342cdef7fedeabafd5d
SHA1 10606ffc00f2400fb2f52d404b30115cb33137e9
SHA512 0dcdd78d8f472168614200900afd479a60106c94deda18c9999c32b1af497c32d9fd41f6039d94bfa28855121e61fb4031e4464b2f074d9fb7024f5f74950efd
SSDEEP 192:fLB7OopThb4h9qRqsHUzKX9zvJkwTFkBo5BoE9c:fLB77pCh97s0zKZvaOc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2284	2336	rundll32.exe	30
PID 2336 wrote to memory of 2284	2336	rundll32.exe	30
PID 2336 wrote to memory of 2284	2336	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2336 -s 140
  2⤵
  PID:2284