22047a945f05b46c4c8629074f9e57b94510f05e417209e8d9c9ec14cc095b45

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/01/2024, 12:50

Target

$PLUGINSDIR/guivgig.dll
Size

161KB
MD5

4512019defa05ddabaf404bb9198c0d5
SHA1

11766c8aab95eab088817bc092668649be343081
SHA256

9d9098ab22edbe4a14e9f879a1e348c480752b49db07d3856874e5f3c53c86c5
SHA512

8d073a81c2314abce508664f1df2f2f3a6a1f88685ed0074832e78a3793da144d068ad82535d9c9008fa73a0fc44d8f9e7fb63ede0bc04fd05bdf0fa42802948
SSDEEP

1536:GNjkGDbcCR5vJuJa0/rzsu0aV+2eGilOQhQLqRLDMLuEXQvue4pLVSYTjgY+6coX:GNjfgCRimR0UquEAvuXjPz+gV9Q5ZAd

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1632	2456	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2456 wrote to memory of 1632	2456	rundll32.exe	29
PID 2456 wrote to memory of 1632	2456	rundll32.exe	29
PID 2456 wrote to memory of 1632	2456	rundll32.exe	29
PID 2456 wrote to memory of 1632	2456	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\guivgig.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\guivgig.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 220
    3⤵
    - Program crash
    PID:1632