595f4fc0f66cfba69430aad00411be104f37958edbbbb773a105b2b9f06f6fa8

Analysis

max time kernel
121s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 05:27

Target

$LOCALAPPDATA/Salad/workloads/gpuz/clrgc.dll
Size

420KB
MD5

58ccec88f3a96bc236b4f76fa3ae8b1d
SHA1

1035acca88ed26a0ab8830b047e94514dd4bbbb9
SHA256

7da076b28ce05595dcbccd618b1a487922f33572dbe8914766e114eec7603720
SHA512

aa14e67fd1f376dfe4a9b119e07e0afeade563bf10077f4787314adc8335832fb81fb2834e0d40cbaf34c111acb1ac0b747142f54e6e3c4f22c15aedd0f340c2
SSDEEP

6144:trAf2NFmdxkWAbHUCG3XQFTJlC1zcXjmOBUOKCGyZlFZZE5zQGwBQJGcquJe/pja:uf2exkWAb0CFXotOKCvlDGgFcpia

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2920	2368	WerFault.exe	30

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2368	2924	rundll32.exe	30
PID 2924 wrote to memory of 2368	2924	rundll32.exe	30
PID 2924 wrote to memory of 2368	2924	rundll32.exe	30
PID 2924 wrote to memory of 2368	2924	rundll32.exe	30
PID 2924 wrote to memory of 2368	2924	rundll32.exe	30
PID 2924 wrote to memory of 2368	2924	rundll32.exe	30
PID 2924 wrote to memory of 2368	2924	rundll32.exe	30
PID 2368 wrote to memory of 2920	2368	rundll32.exe	31
PID 2368 wrote to memory of 2920	2368	rundll32.exe	31
PID 2368 wrote to memory of 2920	2368	rundll32.exe	31
PID 2368 wrote to memory of 2920	2368	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\Salad\workloads\gpuz\clrgc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\Salad\workloads\gpuz\clrgc.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 224
    3⤵
    - Program crash
    PID:2920