97a9006b85e59128c17b85a2e53395b125d4394ed325da83c990189bf8b7004c

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:57

Target

$PLUGINSDIR/ExtractDLLEx.dll
Size

7KB
MD5

ba4063f437abb349aa9120e9c320c467
SHA1

b045d785f6041e25d6be031ae2af4d4504e87b12
SHA256

73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
SHA512

48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a
SSDEEP

96:lyEPmi/06iLbX8SIP59L1MmqPbgkk/eWKCHGojGYYIF/ggiomsTeZUzI:lyEPmymbMbPZOz+/eWJmoUItiopTeZ

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

836 2056 WerFault.exe rundll32.exe

pid	pid_target	process	target process
836	2056	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1284 wrote to memory of 2056	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 2056	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 2056	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 2056	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 2056	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 2056	1284	rundll32.exe	rundll32.exe
PID 1284 wrote to memory of 2056	1284	rundll32.exe	rundll32.exe
PID 2056 wrote to memory of 836	2056	rundll32.exe	WerFault.exe
PID 2056 wrote to memory of 836	2056	rundll32.exe	WerFault.exe
PID 2056 wrote to memory of 836	2056	rundll32.exe	WerFault.exe
PID 2056 wrote to memory of 836	2056	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExtractDLLEx.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\ExtractDLLEx.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 224
3⤵
- Program crash
PID:836