12d5b28d22d8d902d3258d92278299836df03171df250694cf7f55f0101c216e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 16:08

Target

$PLUGINSDIR/cppahhz.dll
Size

153KB
MD5

256a4fd5061e042b52c698808fa161cc
SHA1

4ab8bf6233e87efe2bc7cdce908a894854ca523c
SHA256

3c857fb04ef9e3ecef14cd2c6fc8e19d2b44fe699d0dc9ef1d467731a61cb916
SHA512

6bd24d68bad8763b4e10ab6596dd23f609319d5aa6472f408ba6ccd2bab61b7c1f514337e11963ef076d65cc4b25d0914390a3aecbd1c80b4f785a984ff8eea0
SSDEEP

1536:GS119M9GRwN24gkykW/EEZsu0IXYKFhijQZ1Dyfs7/K0Xg8XmiXSPRzh8CAdwJ+P:Gg1m+ycrd/bXg83XETAGm+AG/XsVi6M

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process
2824	2928	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2928	2508	rundll32.exe	17
PID 2508 wrote to memory of 2928	2508	rundll32.exe	17
PID 2508 wrote to memory of 2928	2508	rundll32.exe	17
PID 2508 wrote to memory of 2928	2508	rundll32.exe	17
PID 2508 wrote to memory of 2928	2508	rundll32.exe	17
PID 2508 wrote to memory of 2928	2508	rundll32.exe	17
PID 2508 wrote to memory of 2928	2508	rundll32.exe	17
PID 2928 wrote to memory of 2824	2928	rundll32.exe	16
PID 2928 wrote to memory of 2824	2928	rundll32.exe	16
PID 2928 wrote to memory of 2824	2928	rundll32.exe	16
PID 2928 wrote to memory of 2824	2928	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cppahhz.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\cppahhz.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 220
1⤵
- Program crash
PID:2824