7c5b449226d2c3e8e65341baffb10b9393282d53b7f6fb164ed788ca2967bb99

Analysis

max time kernel
141s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 23:59

Target
$PLUGINSDIR/System.dll
Size 25KB
Sample240930-31pf4s1cpr
SHA256 322e35bcdd0dd61cad8810bb446c425d8b91ceeba897b13fa0f50f1f48f88056
MD5 46de30b73f6fa1d4ef62ba7b169e0191
SHA1 59850382f1f5f30c840f502d8fc5fc228df33d6d
SHA512 2e51a23297bbe74bb1b1ecc5a7257c546ea43d864e0691a437577431d022f6be5e653dc1ce186698095833245c869bb769c7088ece85851f539b9b763b2cef70
SSDEEP 384:1xnVPk9nL3P0CMxzPJJKZvZvUq5PKpkuKnbyFJVA+:1lBkhP0CMxFwpSkUJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2196	1972	rundll32.exe	30
PID 1972 wrote to memory of 2196	1972	rundll32.exe	30
PID 1972 wrote to memory of 2196	1972	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1972 -s 112
  2⤵
  PID:2196